dscreate

title: dscreate(8)

text:
# dscreate(8)

## NAME
dscreate

## SYNOPSIS
dscreate [-h] [-v] [-j] {from-file,interactive,create-template,ds-root} ...

## POSITIONAL ARGUMENTS
dscreate from-file

Create an instance of Directory Server from an inf answer file

dscreate interactive

Start interactive installer for Directory Server installation

dscreate create-template

Display an example inf answer file, or provide a file name to write it to disk.

dscreate ds-root

Prepare a root directory in which non root user can create, run and administer instances.

## COMMAND 'dscreate from-file'
usage: dscreate from-file [-h] [-n] file

file

Inf file to use with prepared answers. You can generate an example of this with 'dscreate create-template'

## OPTIONS 'dscreate from-file'
-n, --dryrun

Validate system and configurations only. Do not alter the system.

## COMMAND 'dscreate interactive'
usage: dscreate interactive [-h]

## COMMAND 'dscreate create-template'
usage: dscreate create-template [-h] [--advanced] [template_file]

template_file

Write example template to this file

## OPTIONS 'dscreate create-template'
--advanced

Add advanced options to the template - changing the advanced options may make your instance install fail

## COMMAND 'dscreate ds-root'
usage: dscreate ds-root [-h] root_dir [bin_dir]

root_dir

A directory that will be used as virtual root.

bin_dir

A directory in which administration wrappers are installed. (Should be in PATH)

## OPTIONS
-v, --verbose

Display verbose operation tracing during command execution

-j, --json

Return the result as a json message

## COMMENTS
Example of install by a non root user:

PATH=$HOME/bin:$PATH # Should be in .profile

dscreate ds-root $HOME/mydsroot $HOME/bin

hash -d dscreate # bash command to insure new dscreate wrapper will be used

dscreate interactive

\# Note: Make sure to use non priviledged port number (i.e > 1000)

## AUTHOR

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```


dsctl

title: dsctl(8)

text:
# dsctl(8)

## NAME
dsctl

## SYNOPSIS
dsctl [-h] [-v] [-j] [-l] [instance] {restart,start,stop,status,remove,db2index,db2bak,db2ldif,dbverify,bak2db,ldif2db,backups,ldifs,tls,healthcheck,get-nsstate,ldifgen,dsrc,cockpit,dblib} ...

## POSITIONAL ARGUMENTS
dsctl restart

Restart an instance of Directory Server, if it is running: else start it.

dsctl start

Start an instance of Directory Server, if it is not currently running

dsctl stop

Stop an instance of Directory Server, if it is currently running

dsctl status

Check running status of an instance of Directory Server

dsctl remove

Destroy an instance of Directory Server, and remove all data.

dsctl db2index

Initialise a reindex of the server database. The server must be stopped for this to proceed.

dsctl db2bak

Initialise a BDB backup of the database. The server must be stopped for this to proceed.

dsctl db2ldif

Initialise an LDIF dump of the database. The server must be stopped for this to proceed.

dsctl dbverify

Perform a db verification. You should only do this at direction of support

dsctl bak2db

Restore a BDB backup of the database. The server must be stopped for this to proceed.

dsctl ldif2db

Restore an LDIF dump of the database. The server must be stopped for this to proceed.

dsctl backups

List backup's found in the server's default backup directory

dsctl ldifs

List all the LDIF files located in the server's LDIF directory

dsctl tls

Manage TLS certificates

dsctl healthcheck

Run a healthcheck report on a local Directory Server instance. This is a safe and read-only operation. Do not attempt to run this on a remote Directory Server as this tool needs access to local resources, otherwise the report may be inaccurate.

dsctl get-nsstate

Get the replication nsState in a human readable format Replica DN: The DN of the replication configuration entry Replica Suffix: The replicated suffix Replica ID: The Replica identifier Gen Time The time the CSN generator was created Gen Time String: The time string of generator Gen as CSN: The generation CSN Local Offset: The offset due to the local clock being set back Local Offset String: The offset in a nice human format Remote Offset: The offset due to clock difference with remote systems Remote Offset String: The offset in a nice human format Time Skew: The time skew between this server and its replicas Time Skew String: The time skew in a nice human format Seq Num: The number of multiple csns within a second System Time: The local system time Diff in Seconds: The time difference in seconds from the CSN generator creation to now Diff in days/secs: The time difference broken up into days and seconds Endian: Little/Big Endian

dsctl ldifgen

LDIF generator to make sample LDIF files for testing

dsctl dsrc

Manage the .dsrc file

dsctl cockpit

Enable the Cockpit interface/UI

dsctl dblib

database library (i.e bdb/lmdb) migration

## COMMAND 'dsctl restart'
usage: dsctl [-v] [-j] [instance] restart [-h]

## COMMAND 'dsctl start'
usage: dsctl [-v] [-j] [instance] start [-h]

## COMMAND 'dsctl stop'
usage: dsctl [-v] [-j] [instance] stop [-h]

## COMMAND 'dsctl status'
usage: dsctl [-v] [-j] [instance] status [-h]

## COMMAND 'dsctl remove'
usage: dsctl [-v] [-j] [instance] remove [-h] [--do-it]

## OPTIONS 'dsctl remove'
--do-it

By default we do a dry run. This actually initiates the removal of the instance.

## COMMAND 'dsctl db2index'
usage: dsctl [-v] [-j] [instance] db2index [-h] [--attr [ATTR ...]] [backend]

backend

The backend to reindex. IE userRoot

## OPTIONS 'dsctl db2index'
--attr [ATTR ...]

The attribute's to reindex. IE --attr aci cn givenname

## COMMAND 'dsctl db2bak'
usage: dsctl [-v] [-j] [instance] db2bak [-h] [archive]

archive

The destination for the archive. This will be created during the db2bak process.

## COMMAND 'dsctl db2ldif'
usage: dsctl [-v] [-j] [instance] db2ldif [-h] [--replication] [--encrypted]

backend [ldif]

backend

The backend to output as an LDIF. IE userRoot

ldif

The path to the ldif output location.

## OPTIONS 'dsctl db2ldif'
--replication

Export replication information, suitable for importing on a new consumer or backups.

--encrypted

Export encrypted attributes

## COMMAND 'dsctl dbverify'
usage: dsctl [-v] [-j] [instance] dbverify [-h] backend

backend

The backend to verify. IE userRoot

## COMMAND 'dsctl bak2db'
usage: dsctl [-v] [-j] [instance] bak2db [-h] archive

archive

The archive to restore. This will erase all current server databases.

## COMMAND 'dsctl ldif2db'
usage: dsctl [-v] [-j] [instance] ldif2db [-h] [--encrypted] backend ldif

backend

The backend to restore from an LDIF. IE userRoot

ldif

The path to the ldif to import

## OPTIONS 'dsctl ldif2db'
--encrypted

Import encrypted attributes

## COMMAND 'dsctl backups'
usage: dsctl [-v] [-j] [instance] backups [-h] [--delete DELETE]

## OPTIONS 'dsctl backups'
--delete DELETE

Delete backup directory

## COMMAND 'dsctl ldifs'
usage: dsctl [-v] [-j] [instance] ldifs [-h] [--delete DELETE]

## OPTIONS 'dsctl ldifs'
--delete DELETE

Delete LDIF file

## COMMAND 'dsctl tls'
usage: dsctl [-v] [-j] [instance] tls [-h]

{list-ca,list-client-ca,show-server-cert,show-cert,generate-server-cert-csr,import-client-ca,import-ca,import-server-cert,import-server-key-cert,remove-cert,export-cert}

...

## POSITIONAL ARGUMENTS 'dsctl tls'
dsctl tls list-ca

list server certificate authorities including intermediates

dsctl tls list-client-ca

list client certificate authorities including intermediates

dsctl tls show-server-cert

Show the active server certificate that clients will see and verify

dsctl tls show-cert

Show a certificate's details referenced by it's nickname. This is analogous to certutil -L -d <path> -n <nickname>

dsctl tls generate-server-cert-csr

Generate a Server-Cert certificate signing request - the csr is then submitted to a CA for verification, and when signed you import with import-ca and import-server-cert

dsctl tls import-client-ca

Import a CA trusted to issue user (client) certificates. This is part of how client certificate authentication functions.

dsctl tls import-ca

Import a CA or intermediate CA for signing this servers certificates (aka Server-Cert). You should import all the CA's in the chain as required. PEM bundles are accepted

dsctl tls import-server-cert

Import a new Server-Cert after the csr has been signed from a CA.

dsctl tls import-server-key-cert

Import a new key and Server-Cert after having been signed from a CA. This is used if you have an external csr tool or a service like lets encrypt that generates PEM keys externally.

dsctl tls remove-cert

Delete a certificate from this database. This will remove it from acting as a CA, a client CA or the Server-Cert role.

dsctl tls export-cert

Export a certificate to PEM or DER/Binary format. PEM format is the default

## COMMAND 'dsctl tls list-ca'
usage: dsctl [-v] [-j] [instance] tls list-ca [-h]

## COMMAND 'dsctl tls list-client-ca'
usage: dsctl [-v] [-j] [instance] tls list-client-ca [-h]

## COMMAND 'dsctl tls show-server-cert'
usage: dsctl [-v] [-j] [instance] tls show-server-cert [-h]

## COMMAND 'dsctl tls show-cert'
usage: dsctl [-v] [-j] [instance] tls show-cert [-h] nickname

nickname

The nickname (friendly name) of the certificate to display

## COMMAND 'dsctl tls generate-server-cert-csr'
usage: dsctl [-v] [-j] [instance] tls generate-server-cert-csr

[-h] [--subject SUBJECT] [alt_names ...]

alt_names

Certificate requests subject alternative names. These are auto-detected if not provided

## OPTIONS 'dsctl tls generate-server-cert-csr'
--subject SUBJECT, -s SUBJECT

Certificate Subject field to use

## COMMAND 'dsctl tls import-client-ca'
usage: dsctl [-v] [-j] [instance] tls import-client-ca [-h] cert_path nickname

cert_path

The path to the x509 cert to import as a client trust root

nickname

The name of the certificate once imported

## COMMAND 'dsctl tls import-ca'
usage: dsctl [-v] [-j] [instance] tls import-ca [-h]

cert_path nickname

[nickname ...]

cert_path

The path to the x509 cert to import as a server CA

nickname

The name of the certificate once imported

## COMMAND 'dsctl tls import-server-cert'
usage: dsctl [-v] [-j] [instance] tls import-server-cert [-h] cert_path

cert_path

The path to the x509 cert to import as Server-Cert

## COMMAND 'dsctl tls import-server-key-cert'
usage: dsctl [-v] [-j] [instance] tls import-server-key-cert

[-h] cert_path key_path

cert_path

The path to the x509 cert to import as Server-Cert

key_path

The path to the x509 key to import associated to Server-Cert

## COMMAND 'dsctl tls remove-cert'
usage: dsctl [-v] [-j] [instance] tls remove-cert [-h] nickname

nickname

The name of the certificate to delete

## COMMAND 'dsctl tls export-cert'
usage: dsctl [-v] [-j] [instance] tls export-cert [-h] [--binary-format]

[--output-file OUTPUT_FILE]

nickname

nickname

The name of the certificate to export

## OPTIONS 'dsctl tls export-cert'
--binary-format

Export certificate in DER/binary format

--output-file OUTPUT_FILE

The name for the exported certificate. Default name is the certificate nickname with an extension of ".pem" or ".crt"

## COMMAND 'dsctl healthcheck'
usage: dsctl [instance] healthcheck [-h] [--list-checks] [--list-errors]

[--dry-run] [--check CHECK [CHECK ...]]

[--exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...]]

## OPTIONS 'dsctl healthcheck'
--list-checks

List of known checks

--list-errors

List of known error codes

--dry-run

Do not execute the actual check, only list what would be done

--check CHECK [CHECK ...]

Areas to check. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available.

--exclude-check EXCLUDE_CHECK [EXCLUDE_CHECK ...]

Areas to skip. These can be obtained by --list-checks. Every element on the left of the colon (:) may be replaced by an asterisk if multiple options on the right are available.

## COMMAND 'dsctl get-nsstate'
usage: dsctl [instance] get-nsstate [-h] [--suffix SUFFIX] [--flip FLIP]

## OPTIONS 'dsctl get-nsstate'
--suffix SUFFIX

The DN of the replication suffix to read the state from

--flip FLIP

Flip between Little/Big Endian, this might be required for certain architectures

## COMMAND 'dsctl ldifgen'
usage: dsctl [-v] [-j] [instance] ldifgen [-h]

{users,groups,cos-def,cos-template,roles,mod-load,nested}

...

## POSITIONAL ARGUMENTS 'dsctl ldifgen'
dsctl ldifgen users

Generate a LDIF containing user entries

dsctl ldifgen groups

Generate a LDIF containing groups and members

dsctl ldifgen cos-def

Generate a LDIF containing a COS definition (classic, pointer, or indirect)

dsctl ldifgen cos-template

Generate a LDIF containing a COS template

dsctl ldifgen roles

Generate a LDIF containing a role entry (managed, filtered, or indirect)

dsctl ldifgen mod-load

Generate a LDIF containing modify operations. This is intended to be consumed by ldapmodify.

dsctl ldifgen nested

Generate a heavily nested database LDIF in a cascading/fractal tree design

## COMMAND 'dsctl ldifgen users'
usage: dsctl [-v] [-j] [instance] ldifgen users [-h] [--number NUMBER]

[--suffix SUFFIX]

[--parent PARENT] [--generic]

[--start-idx START_IDX]

[--rdn-cn] [--localize]

[--ldif-file LDIF_FILE]

## OPTIONS 'dsctl ldifgen users'
--number NUMBER

The number of users to create.

--suffix SUFFIX

The database suffix where the entries will be created.

--parent PARENT

The parent entry that the user entries should be created under. If not specified, the entries are stored under random Organizational Units.

--generic

Create generic entries in the format of "uid=user####". These entries are also compatible with ldclt.

--start-idx START_IDX

For generic LDIF's you can choose the starting index for the user entries. The default is "0".

--rdn-cn

Use the attribute "cn" as the RDN attribute in the DN instead of "uid"

--localize

Localize the LDIF data

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen groups'
usage: dsctl [-v] [-j] [instance] ldifgen groups [-h] [--number NUMBER]

[--suffix SUFFIX]

[--parent PARENT]

[--num-members NUM_MEMBERS]

[--create-members]

[--member-parent MEMBER_PARENT]

[--member-attr MEMBER_ATTR]

[--ldif-file LDIF_FILE]

NAME

NAME

The group name.

## OPTIONS 'dsctl ldifgen groups'
--number NUMBER

The number of groups to create.

--suffix SUFFIX

The database suffix where the groups will be created.

--parent PARENT

The parent entry that the group entries should be created under. If not specified the groups are stored under the suffix.

--num-members NUM_MEMBERS

The number of members in the group. Default is 10000

--create-members

Create the member user entries.

--member-parent MEMBER_PARENT

The entry DN that the members should be created under. The default is the suffix entry.

--member-attr MEMBER_ATTR

The membership attribute to use in the group. Default is "uniquemember".

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen cos-def'
usage: dsctl [-v] [-j] [instance] ldifgen cos-def [-h] [--type TYPE]

[--parent PARENT]

[--create-parent]

[--cos-specifier COS_SPECIFIER]

[--cos-template COS_TEMPLATE]

[--cos-attr [COS_ATTR ...]]

[--ldif-file LDIF_FILE]

NAME

NAME

The COS definition name.

## OPTIONS 'dsctl ldifgen cos-def'
--type TYPE

The COS definition type: "classic", "pointer", or "indirect".

--parent PARENT

The parent entry that the COS definition should be created under.

--create-parent

Create the parent entry

--cos-specifier COS_SPECIFIER

Used in a classic COS definition, this attribute located in the user entry is used to select which COS template to use.

--cos-template COS_TEMPLATE

The DN of the COS template entry, only used for "classic" and "pointer" COS definitions.

--cos-attr [COS_ATTR ...]

A list of attributes which defines which attribute the COS generates values for.

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen cos-template'
usage: dsctl [-v] [-j] [instance] ldifgen cos-template [-h] [--parent PARENT]

[--create-parent]

[--cos-priority COS_PRIORITY]

[--cos-attr-val COS_ATTR_VAL]

[--ldif-file LDIF_FILE]

NAME

NAME

The COS template name.

## OPTIONS 'dsctl ldifgen cos-template'
--parent PARENT

The DN of the entry to store the COS template entry under.

--create-parent

Create the parent entry

--cos-priority COS_PRIORITY

Sets the priority of this conflicting/competing COS templates.

--cos-attr-val COS_ATTR_VAL

defines the attribute and value that the template provides.

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen roles'
usage: dsctl [-v] [-j] [instance] ldifgen roles [-h] [--type TYPE]

[--parent PARENT]

[--create-parent]

[--filter FILTER]

[--role-dn [ROLE_DN ...]]

[--ldif-file LDIF_FILE]

NAME

NAME

The Role name.

## OPTIONS 'dsctl ldifgen roles'
--type TYPE

The Role type: "managed", "filtered", or "nested".

--parent PARENT

The DN of the entry to store the Role entry under

--create-parent

Create the parent entry

--filter FILTER

A search filter for gathering Role members. Required for a "filtered" role.

--role-dn [ROLE_DN ...]

A DN of a role entry that should be included in this role. Used for "nested" roles only.

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen mod-load'
usage: dsctl [-v] [-j] [instance] ldifgen mod-load [-h] [--create-users]

[--delete-users]

[--num-users NUM_USERS]

[--parent PARENT]

[--create-parent]

[--add-users ADD_USERS]

[--del-users DEL_USERS]

[--modrdn-users MODRDN_USERS]

[--mod-users MOD_USERS]

[--mod-attrs [MOD_ATTRS ...]]

[--randomize]

[--ldif-file LDIF_FILE]

## OPTIONS 'dsctl ldifgen mod-load'
--create-users

Create the entries that will be modified or deleted. By default the script assumes the user entries already exist.

--delete-users

Delete all the user entries at the end of the LDIF.

--num-users NUM_USERS

The number of user entries that will be modified or deleted

--parent PARENT

The DN of the parent entry where the user entries are located.

--create-parent

Create the parent entry

--add-users ADD_USERS

The number of additional entries to add during the load.

--del-users DEL_USERS

The number of entries to delete during the load.

--modrdn-users MODRDN_USERS

The number of entries to perform a modrdn operation on.

--mod-users MOD_USERS

The number of entries to modify.

--mod-attrs [MOD_ATTRS ...]

List of attributes the script will randomly choose from when modifying an entry. The default is "description".

--randomize

Randomly perform the specified add, mod, delete, and modrdn operations

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl ldifgen nested'
usage: dsctl [-v] [-j] [instance] ldifgen nested [-h] [--num-users NUM_USERS]

[--node-limit NODE_LIMIT]

[--suffix SUFFIX]

[--ldif-file LDIF_FILE]

## OPTIONS 'dsctl ldifgen nested'
--num-users NUM_USERS

The total number of user entries to create in the entire LDIF (does not include the container entries).

--node-limit NODE_LIMIT

The total number of user entries to create under each node/subtree

--suffix SUFFIX

The suffix DN for the LDIF

--ldif-file LDIF_FILE

The LDIF file name. Default location is the server's LDIF directory using the name 'ldifgen.ldif'

## COMMAND 'dsctl dsrc'
usage: dsctl [-v] [-j] [instance] dsrc [-h] {create,modify,delete,display,repl-mon} ...

## POSITIONAL ARGUMENTS 'dsctl dsrc'
dsctl dsrc create

Generate the .dsrc file

dsctl dsrc modify

Modify the .dsrc file

dsctl dsrc delete

Delete instance configuration from the .dsrc file.

dsctl dsrc display

Display the contents of the .dsrc file.

dsctl dsrc repl-mon

Display the contents of the .dsrc file.

## COMMAND 'dsctl dsrc create'
usage: dsctl [-v] [-j] [instance] dsrc create [-h] [--uri URI]

[--basedn BASEDN]

[--people-rdn PEOPLE_RDN]

[--groups-rdn GROUPS_RDN]

[--binddn BINDDN]

[--saslmech SASLMECH]

[--tls-cacertdir TLS_CACERTDIR]

[--tls-cert TLS_CERT]

[--tls-key TLS_KEY]

[--tls-reqcert TLS_REQCERT]

[--starttls] [--pwdfile PWDFILE]

[--do-it]

## OPTIONS 'dsctl dsrc create'
--uri URI

The URI (LDAP URL) for the Directory Server instance.

--basedn BASEDN

The default database suffix.

--people-rdn PEOPLE_RDN

Set the RDN for the 'people' subtree. Default is "ou=people"

--groups-rdn GROUPS_RDN

Set the RDN for the 'groups' subtree. Default is "ou=groups"

--binddn BINDDN

The default Bind DN used or authentication.

--saslmech SASLMECH

The SASL mechanism to use: PLAIN or EXTERNAL.

--tls-cacertdir TLS_CACERTDIR

The directory containing the Trusted Certificate Authority certificate.

--tls-cert TLS_CERT

The absolute file name to the server certificate.

--tls-key TLS_KEY

The absolute file name to the server certificate key.

--tls-reqcert TLS_REQCERT

Request certificate strength: 'never', 'allow', 'hard'

--starttls

Use startTLS for connection to the server.

--pwdfile PWDFILE

The absolute path to a file containing the Bind DN's password.

--do-it

Create the file without any confirmation.

## COMMAND 'dsctl dsrc modify'
usage: dsctl [-v] [-j] [instance] dsrc modify [-h] [--uri [URI]]

[--basedn [BASEDN]]

[--people-rdn [PEOPLE_RDN]]

[--groups-rdn [GROUPS_RDN]]

[--binddn [BINDDN]]

[--saslmech [SASLMECH]]

[--tls-cacertdir [TLS_CACERTDIR]]

[--tls-cert [TLS_CERT]]

[--tls-key [TLS_KEY]]

[--tls-reqcert [TLS_REQCERT]]

[--starttls] [--cancel-starttls]

[--pwdfile [PWDFILE]] [--do-it]

## OPTIONS 'dsctl dsrc modify'
--uri [URI]

The URI (LDAP URL) for the Directory Server instance.

--basedn [BASEDN]

The default database suffix.

--people-rdn [PEOPLE_RDN]

Sets the RDN used for the 'people' container

--groups-rdn [GROUPS_RDN]

Sets the RDN used for the 'groups' container

--binddn [BINDDN]

The default Bind DN used or authentication.

--saslmech [SASLMECH]

The SASL mechanism to use: PLAIN or EXTERNAL.

--tls-cacertdir [TLS_CACERTDIR]

The directory containing the Trusted Certificate Authority certificate.

--tls-cert [TLS_CERT]

The absolute file name to the server certificate.

--tls-key [TLS_KEY]

The absolute file name to the server certificate key.

--tls-reqcert [TLS_REQCERT]

Request certificate strength: 'never', 'allow', 'hard'

--starttls

Use startTLS for connection to the server.

--cancel-starttls

Do not use startTLS for connection to the server.

--pwdfile [PWDFILE]

The absolute path to a file containing the Bind DN's password.

--do-it

Update the file without any confirmation.

## COMMAND 'dsctl dsrc delete'
usage: dsctl [-v] [-j] [instance] dsrc delete [-h] [--do-it]

## OPTIONS 'dsctl dsrc delete'
--do-it

Delete this instance's configuration from the .dsrc file.

## COMMAND 'dsctl dsrc display'
usage: dsctl [-v] [-j] [instance] dsrc display [-h]

## COMMAND 'dsctl dsrc repl-mon'
usage: dsctl [-v] [-j] [instance] dsrc repl-mon [-h]

[--add-conn ADD_CONN [ADD_CONN ...]]

[--del-conn DEL_CONN [DEL_CONN ...]]

[--add-alias ADD_ALIAS [ADD_ALIAS ...]]

[--del-alias DEL_ALIAS [DEL_ALIAS ...]]

## OPTIONS 'dsctl dsrc repl-mon'
--add-conn ADD_CONN [ADD_CONN ...]

Add a replica connection: 'NAME:HOST:PORT:BINDDN:CREDENTIAL'

--del-conn DEL_CONN [DEL_CONN ...]

delete a replica connection by its NAME

--add-alias ADD_ALIAS [ADD_ALIAS ...]

Add a host/port alias: 'ALIAS_NAME:HOST:PORT'

--del-alias DEL_ALIAS [DEL_ALIAS ...]

delete a host/port alias by its ALIAS_NAME

## COMMAND 'dsctl cockpit'
usage: dsctl [-v] [-j] [instance] cockpit [-h]

{enable,open-firewall,disable,close-firewall}

...

## POSITIONAL ARGUMENTS 'dsctl cockpit'
dsctl cockpit enable

Enable the Cockpit socket

dsctl cockpit open-firewall

Open the firewall for the "cockpit" service

dsctl cockpit disable

Disable the Cockpit socket

dsctl cockpit close-firewall

Remove the "cockpit" service from the firewall settings

## COMMAND 'dsctl cockpit enable'
usage: dsctl [-v] [-j] [instance] cockpit enable [-h]

## COMMAND 'dsctl cockpit open-firewall'
usage: dsctl [-v] [-j] [instance] cockpit open-firewall [-h] [--zone ZONE]

## OPTIONS 'dsctl cockpit open-firewall'
--zone ZONE

The firewall zone

## COMMAND 'dsctl cockpit disable'
usage: dsctl [-v] [-j] [instance] cockpit disable [-h]

## COMMAND 'dsctl cockpit close-firewall'
usage: dsctl [-v] [-j] [instance] cockpit close-firewall [-h]

## COMMAND 'dsctl dblib'
usage: dsctl [-v] [-j] [instance] dblib [-h] {bdb2mdb,mdb2bdb,cleanup} ...

## POSITIONAL ARGUMENTS 'dsctl dblib'
dsctl dblib bdb2mdb

Migrate bdb databases to lmdb

dsctl dblib mdb2bdb

Migrate lmdb databases to bdb

dsctl dblib cleanup

Remove migration ldif file and old database

## COMMAND 'dsctl dblib bdb2mdb'
usage: dsctl [-v] [-j] [instance] dblib bdb2mdb [-h] [--tmpdir TMPDIR]

## OPTIONS 'dsctl dblib bdb2mdb'
--tmpdir TMPDIR

ldif migration files directory path.

## COMMAND 'dsctl dblib mdb2bdb'
usage: dsctl [-v] [-j] [instance] dblib mdb2bdb [-h] [--tmpdir TMPDIR]

## OPTIONS 'dsctl dblib mdb2bdb'
--tmpdir TMPDIR

ldif migration files directory path.

## COMMAND 'dsctl dblib cleanup'
usage: dsctl [-v] [-j] [instance] dblib cleanup [-h]

## OPTIONS
-v, --verbose

Display verbose operation tracing during command execution

-j, --json

Return result in JSON object

-l, --list

List available Directory Server instances

## AUTHOR

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```


dsidm

title: dsidm(8)

text:
# dsidm(8)

## NAME
dsidm

## SYNOPSIS
dsidm [-h] [-v] [-j] [-b BASEDN] [-D BINDDN] [-w BINDPW] [-W] [-y PWDFILE] [-Z] instance {account,group,initialise,init,organizationalunit,ou,posixgroup,user,client_config,role,service,uniquegroup} ...

## POSITIONAL ARGUMENTS
dsidm account

Manage generic accounts, with tasks like modify, locking and unlocking. To create an account, see "user" subcommand instead.

dsidm group

Manage groups. The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups. Groups uses the objectclass "groupOfNames" and the grouping attribute "member"

dsidm initialise

Initialise a backend with domain information and sample entries

dsidm organizationalunit

Manage organizational units

dsidm posixgroup

Manage posix groups The organizationalUnit (by default ou=groups") needs to exist prior to managing posix groups.

dsidm user

Manage posix users. The organizationalUnit (by default "ou=people") needs to exist prior to managing users.

dsidm client_config

Display and generate client example configs for this LDAP server

dsidm role

Manage roles.

dsidm service

Manage service accounts. The organizationalUnit (by default "ou=Services") needs to exist prior to managing service accounts.

dsidm uniquegroup

Manage groups. The organizationalUnit (by default "ou=groups") needs to exist prior to managing groups. Unique groups uses the objectclass "groupOfUniqueNames" and the grouping attribute "uniquemember"

## COMMAND 'dsidm account'
usage: dsidm instance account [-h]

{list,get-by-dn,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status,reset_password,change_password,bulk_update}

...

## POSITIONAL ARGUMENTS 'dsidm account'
dsidm account list

list accounts that could login to the directory (returns the full DN of the entry)

dsidm account get-by-dn

get-by-dn <dn>

dsidm account modify-by-dn

modify-by-dn <dn> <add|delete|replace>:<attribute>:<value> ...

dsidm account rename-by-dn

rename the object

dsidm account delete

deletes the account

dsidm account lock

lock

dsidm account unlock

unlock

dsidm account entry-status

status of a single entry

dsidm account subtree-status

status of a subtree

dsidm account reset_password

Reset the password of an account. This should be performed by a directory admin.

dsidm account change_password

Change the password of an account. This can be performed by any user (with correct rights)

dsidm account bulk_update

Perform a common operation to a set of entries

## COMMAND 'dsidm account list'
usage: dsidm [-v] [-j] instance account list [-h]

## COMMAND 'dsidm account get-by-dn'
usage: dsidm [-v] [-j] instance account get-by-dn [-h] [dn]

dn

The dn to get and display

## COMMAND 'dsidm account modify-by-dn'
usage: dsidm [-v] [-j] instance account modify-by-dn [-h] dn changes [changes ...]

dn

The dn to get and display

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm account rename-by-dn'
usage: dsidm [-v] [-j] instance account rename-by-dn [-h] [--keep-old-rdn] dn new_dn

dn

The dn to rename

new_dn

A new role dn

## OPTIONS 'dsidm account rename-by-dn'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_role') should be kept as an attribute of the entry or not

## COMMAND 'dsidm account delete'
usage: dsidm [-v] [-j] instance account delete [-h] [dn]

dn

The dn of the account to delete

## COMMAND 'dsidm account lock'
usage: dsidm [-v] [-j] instance account lock [-h] [dn]

dn

The dn to lock

## COMMAND 'dsidm account unlock'
usage: dsidm [-v] [-j] instance account unlock [-h] [dn]

dn

The dn to unlock

## COMMAND 'dsidm account entry-status'
usage: dsidm [-v] [-j] instance account entry-status [-h] [-V] [dn]

dn

The single entry dn to check

## OPTIONS 'dsidm account entry-status'
-V, --details

Print more account policy details about the entry

## COMMAND 'dsidm account subtree-status'
usage: dsidm [-v] [-j] instance account subtree-status [-h] [-V] [-f FILTER]

[-s {one,sub}] [-i]

[-o BECOME_INACTIVE_ON]

basedn

basedn

Search base for finding entries

## OPTIONS 'dsidm account subtree-status'
-V, --details

Print more account policy details about the entries

-f FILTER, --filter FILTER

Search filter for finding entries

-s {one,sub}, --scope {one,sub}

Search scope (one, sub - default is sub

-i, --inactive-only

Only display inactivated entries

-o BECOME_INACTIVE_ON, --become-inactive-on BECOME_INACTIVE_ON

Only display entries that will become inactive before specified date (in a format 2007-04-25T14:30)

## COMMAND 'dsidm account reset_password'
usage: dsidm [-v] [-j] instance account reset_password [-h] [dn] [new_password]

dn

The dn to reset the password for

new_password

The new password to set

## COMMAND 'dsidm account change_password'
usage: dsidm [-v] [-j] instance account change_password [-h]

[dn] [new_password]

[current_password]

dn

The dn to change the password for

new_password

The new password to set

current_password

The accounts current password

## COMMAND 'dsidm account bulk_update'
usage: dsidm [-v] [-j] instance account bulk_update [-h] [-f FILTER] [-s {one,sub}] [-x]

basedn changes [changes ...]

basedn

Search base for finding entries, only the children of this DN are processed

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## OPTIONS 'dsidm account bulk_update'
-f FILTER, --filter FILTER

Search filter for finding entries, default is '(objectclass=*)'

-s {one,sub}, --scope {one,sub}

Search scope (one, sub - default is sub

-x, --stop

Stop processing updates when an error occurs. Default is False

## COMMAND 'dsidm group'
usage: dsidm instance group [-h]

{list,get,get_dn,create,delete,modify,rename,members,add_member,remove_member}

...

## POSITIONAL ARGUMENTS 'dsidm group'
dsidm group list

list

dsidm group get

get

dsidm group get_dn

get_dn

dsidm group create

create

dsidm group delete

deletes the object

dsidm group modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm group rename

rename the object

dsidm group members

List member dns of a group

dsidm group add_member

Add a member to a group

dsidm group remove_member

Remove a member from a group

## COMMAND 'dsidm group list'
usage: dsidm [-v] [-j] instance group list [-h] [--full-dn]

## OPTIONS 'dsidm group list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm group get'
usage: dsidm [-v] [-j] instance group get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm group get_dn'
usage: dsidm [-v] [-j] instance group get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm group create'
usage: dsidm [-v] [-j] instance group create [-h] [--cn [CN]]

[--description [DESCRIPTION]]

## OPTIONS 'dsidm group create'
--cn [CN]

Value of cn

--description [DESCRIPTION]

Value of description

## COMMAND 'dsidm group delete'
usage: dsidm [-v] [-j] instance group delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm group modify'
usage: dsidm [-v] [-j] instance group modify [-h] selector changes [changes ...]

selector

The cn to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm group rename'
usage: dsidm [-v] [-j] instance group rename [-h] [--keep-old-rdn] selector new_name

selector

The cn to rename

new_name

A new group name

## OPTIONS 'dsidm group rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_group') should be kept as an attribute of the entry or not

## COMMAND 'dsidm group members'
usage: dsidm [-v] [-j] instance group members [-h] [cn]

cn

cn of group to list members of

## COMMAND 'dsidm group add_member'
usage: dsidm [-v] [-j] instance group add_member [-h] [cn] [dn]

cn

cn of group to add member to

dn

dn of object to add to group as member

## COMMAND 'dsidm group remove_member'
usage: dsidm [-v] [-j] instance group remove_member [-h] [cn] [dn]

cn

cn of group to remove member from

dn

dn of object to remove from group as member

## COMMAND 'dsidm initialise'
usage: dsidm [-v] [-j] instance initialise [-h] [--version VERSION]

## OPTIONS 'dsidm initialise'
--version VERSION

The version of entries to create.

## COMMAND 'dsidm organizationalunit'
usage: dsidm [-v] [-j] instance organizationalunit [-h]

{list,get,get_dn,create,delete,modify,rename}

...

## POSITIONAL ARGUMENTS 'dsidm organizationalunit'
dsidm organizationalunit list

list

dsidm organizationalunit get

get

dsidm organizationalunit get_dn

get_dn

dsidm organizationalunit create

create

dsidm organizationalunit delete

deletes the object

dsidm organizationalunit modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm organizationalunit rename

rename the object

## COMMAND 'dsidm organizationalunit list'
usage: dsidm [-v] [-j] instance organizationalunit list [-h] [--full-dn]

## OPTIONS 'dsidm organizationalunit list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm organizationalunit get'
usage: dsidm [-v] [-j] instance organizationalunit get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm organizationalunit get_dn'
usage: dsidm [-v] [-j] instance organizationalunit get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm organizationalunit create'
usage: dsidm [-v] [-j] instance organizationalunit create [-h] [--ou [OU]]

## OPTIONS 'dsidm organizationalunit create'
--ou [OU]

Value of ou

## COMMAND 'dsidm organizationalunit delete'
usage: dsidm [-v] [-j] instance organizationalunit delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm organizationalunit modify'
usage: dsidm [-v] [-j] instance organizationalunit modify [-h]

selector changes

[changes ...]

selector

The ou to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm organizationalunit rename'
usage: dsidm [-v] [-j] instance organizationalunit rename [-h]

[--keep-old-rdn]

selector new_name

selector

The ou to rename

new_name

A new organizational unit name

## OPTIONS 'dsidm organizationalunit rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'ou: old_ou') should be kept as an attribute of the entry or not

## COMMAND 'dsidm posixgroup'
usage: dsidm instance posixgroup [-h]

{list,get,get_dn,create,delete,modify,rename}

...

## POSITIONAL ARGUMENTS 'dsidm posixgroup'
dsidm posixgroup list

list

dsidm posixgroup get

get

dsidm posixgroup get_dn

get_dn

dsidm posixgroup create

create

dsidm posixgroup delete

deletes the object

dsidm posixgroup modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm posixgroup rename

rename the object

## COMMAND 'dsidm posixgroup list'
usage: dsidm [-v] [-j] instance posixgroup list [-h] [--full-dn]

## OPTIONS 'dsidm posixgroup list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm posixgroup get'
usage: dsidm [-v] [-j] instance posixgroup get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm posixgroup get_dn'
usage: dsidm [-v] [-j] instance posixgroup get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm posixgroup create'
usage: dsidm [-v] [-j] instance posixgroup create [-h] [--cn [CN]]

[--gidNumber [GIDNUMBER]]

## OPTIONS 'dsidm posixgroup create'
--cn [CN]

Value of cn

--gidNumber [GIDNUMBER]

Value of gidNumber

## COMMAND 'dsidm posixgroup delete'
usage: dsidm [-v] [-j] instance posixgroup delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm posixgroup modify'
usage: dsidm [-v] [-j] instance posixgroup modify [-h] selector changes [changes ...]

selector

The cn to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm posixgroup rename'
usage: dsidm [-v] [-j] instance posixgroup rename [-h] [--keep-old-rdn]

selector new_name

selector

The cn to rename

new_name

A new posix group name

## OPTIONS 'dsidm posixgroup rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_group') should be kept as an attribute of the entry or not

## COMMAND 'dsidm user'
usage: dsidm instance user [-h]

{list,get,get_dn,create,modify,rename,delete} ...

## POSITIONAL ARGUMENTS 'dsidm user'
dsidm user list

list

dsidm user get

get

dsidm user get_dn

get_dn

dsidm user create

create

dsidm user modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm user rename

rename the object

dsidm user delete

deletes the object

## COMMAND 'dsidm user list'
usage: dsidm [-v] [-j] instance user list [-h] [--full-dn]

## OPTIONS 'dsidm user list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm user get'
usage: dsidm [-v] [-j] instance user get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm user get_dn'
usage: dsidm [-v] [-j] instance user get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm user create'
usage: dsidm [-v] [-j] instance user create [-h] [--uid [UID]] [--cn [CN]]

[--displayName [DISPLAYNAME]]

[--uidNumber [UIDNUMBER]]

[--gidNumber [GIDNUMBER]]

[--homeDirectory [HOMEDIRECTORY]]

## OPTIONS 'dsidm user create'
--uid [UID]

Value of uid

--cn [CN]

Value of cn

--displayName [DISPLAYNAME]

Value of displayName

--uidNumber [UIDNUMBER]

Value of uidNumber

--gidNumber [GIDNUMBER]

Value of gidNumber

--homeDirectory [HOMEDIRECTORY]

Value of homeDirectory

## COMMAND 'dsidm user modify'
usage: dsidm [-v] [-j] instance user modify [-h] selector changes [changes ...]

selector

The uid to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm user rename'
usage: dsidm [-v] [-j] instance user rename [-h] [--keep-old-rdn] selector new_name

selector

The uid to modify

new_name

A new user name

## OPTIONS 'dsidm user rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_user') should be kept as an attribute of the entry or not

## COMMAND 'dsidm user delete'
usage: dsidm [-v] [-j] instance user delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm client_config'
usage: dsidm instance client_config [-h] {sssd.conf,ldap.conf,display} ...

## POSITIONAL ARGUMENTS 'dsidm client_config'
dsidm client_config sssd.conf

Generate a SSSD configuration for this LDAP server

dsidm client_config ldap.conf

Generate an OpenLDAP ldap.conf configuration for this LDAP server

dsidm client_config display

Display generic application parameters for LDAP connection

## COMMAND 'dsidm client_config sssd.conf'
usage: dsidm instance client_config sssd.conf [-h] [allowed_group]

allowed_group

The name of the group allowed access to this system

## COMMAND 'dsidm client_config ldap.conf'
usage: dsidm instance client_config ldap.conf [-h]

## COMMAND 'dsidm client_config display'
usage: dsidm instance client_config display [-h]

## COMMAND 'dsidm role'
usage: dsidm [-v] [-j] instance role [-h]

{list,get,get-by-dn,create-managed,create-filtered,create-nested,modify-by-dn,rename-by-dn,delete,lock,unlock,entry-status,subtree-status}

...

## POSITIONAL ARGUMENTS 'dsidm role'
dsidm role list

list roles that could login to the directory

dsidm role get

get

dsidm role get-by-dn

get-by-dn <dn>

dsidm role create-managed

create

dsidm role create-filtered

create

dsidm role create-nested

create

dsidm role modify-by-dn

modify-by-dn <dn> <add|delete|replace>:<attribute>:<value> ...

dsidm role rename-by-dn

rename the object

dsidm role delete

deletes the role

dsidm role lock

lock

dsidm role unlock

unlock

dsidm role entry-status

status of a single entry

dsidm role subtree-status

status of a subtree

## COMMAND 'dsidm role list'
usage: dsidm [-v] [-j] instance role list [-h] [--full-dn]

## OPTIONS 'dsidm role list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm role get'
usage: dsidm [-v] [-j] instance role get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm role get-by-dn'
usage: dsidm [-v] [-j] instance role get-by-dn [-h] [dn]

dn

The dn to get and display

## COMMAND 'dsidm role create-managed'
usage: dsidm [-v] [-j] instance role create-managed [-h] [--cn [CN]]

## OPTIONS 'dsidm role create-managed'
--cn [CN]

Value of cn

## COMMAND 'dsidm role create-filtered'
usage: dsidm [-v] [-j] instance role create-filtered [-h] [--cn [CN]]

## OPTIONS 'dsidm role create-filtered'
--cn [CN]

Value of cn

## COMMAND 'dsidm role create-nested'
usage: dsidm [-v] [-j] instance role create-nested [-h] [--cn [CN]]

[--nsroledn [NSROLEDN]]

## OPTIONS 'dsidm role create-nested'
--cn [CN]

Value of cn

--nsroledn [NSROLEDN]

Value of nsroledn

## COMMAND 'dsidm role modify-by-dn'
usage: dsidm [-v] [-j] instance role modify-by-dn [-h]

dn changes [changes ...]

dn

The dn to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm role rename-by-dn'
usage: dsidm [-v] [-j] instance role rename-by-dn [-h] [--keep-old-rdn]

dn new_dn

dn

The dn to rename

new_dn

A new account dn

## OPTIONS 'dsidm role rename-by-dn'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_account') should be kept as an attribute of the entry or not

## COMMAND 'dsidm role delete'
usage: dsidm [-v] [-j] instance role delete [-h] [dn]

dn

The dn of the role to delete

## COMMAND 'dsidm role lock'
usage: dsidm [-v] [-j] instance role lock [-h] [dn]

dn

The dn to lock

## COMMAND 'dsidm role unlock'
usage: dsidm [-v] [-j] instance role unlock [-h] [dn]

dn

The dn to unlock

## COMMAND 'dsidm role entry-status'
usage: dsidm [-v] [-j] instance role entry-status [-h] [dn]

dn

The single entry dn to check

## COMMAND 'dsidm role subtree-status'
usage: dsidm [-v] [-j] instance role subtree-status [-h] [-f FILTER]

[-s {base,one,sub}]

basedn

basedn

Search base for finding entries

## OPTIONS 'dsidm role subtree-status'
-f FILTER, --filter FILTER

Search filter for finding entries

-s {base,one,sub}, --scope {base,one,sub}

Search scope (base, one, sub - default is sub

## COMMAND 'dsidm service'
usage: dsidm [-v] [-j] instance service [-h]

{list,get,get_dn,create,modify,rename,delete}

...

## POSITIONAL ARGUMENTS 'dsidm service'
dsidm service list

list

dsidm service get

get

dsidm service get_dn

get_dn

dsidm service create

create

dsidm service modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm service rename

rename the object

dsidm service delete

deletes the object

## COMMAND 'dsidm service list'
usage: dsidm [-v] [-j] instance service list [-h] [--full-dn]

## OPTIONS 'dsidm service list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm service get'
usage: dsidm [-v] [-j] instance service get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm service get_dn'
usage: dsidm [-v] [-j] instance service get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm service create'
usage: dsidm [-v] [-j] instance service create [-h] [--cn [CN]]

[--description [DESCRIPTION]]

## OPTIONS 'dsidm service create'
--cn [CN]

Value of cn

--description [DESCRIPTION]

Value of description

## COMMAND 'dsidm service modify'
usage: dsidm [-v] [-j] instance service modify [-h]

selector changes [changes ...]

selector

The cn to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm service rename'
usage: dsidm [-v] [-j] instance service rename [-h] [--keep-old-rdn]

selector new_name

selector

The cn to modify

new_name

A new service name

## OPTIONS 'dsidm service rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_service') should be kept as an attribute of the entry or not

## COMMAND 'dsidm service delete'
usage: dsidm [-v] [-j] instance service delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm uniquegroup'
usage: dsidm instance uniquegroup [-h]

{list,get,get_dn,create,delete,modify,rename,members,add_member,remove_member}

...

## POSITIONAL ARGUMENTS 'dsidm uniquegroup'
dsidm uniquegroup list

list

dsidm uniquegroup get

get

dsidm uniquegroup get_dn

get_dn

dsidm uniquegroup create

create

dsidm uniquegroup delete

deletes the object

dsidm uniquegroup modify

modify <add|delete|replace>:<attribute>:<value> ...

dsidm uniquegroup rename

rename the object

dsidm uniquegroup members

List member dns of a group

dsidm uniquegroup add_member

Add a member to a group

dsidm uniquegroup remove_member

Remove a member from a group

## COMMAND 'dsidm uniquegroup list'
usage: dsidm [-v] [-j] instance uniquegroup list [-h] [--full-dn]

## OPTIONS 'dsidm uniquegroup list'
--full-dn

Return the full DN of the entry instead of the RDN value

## COMMAND 'dsidm uniquegroup get'
usage: dsidm [-v] [-j] instance uniquegroup get [-h] [selector]

selector

The term to search for

## COMMAND 'dsidm uniquegroup get_dn'
usage: dsidm [-v] [-j] instance uniquegroup get_dn [-h] [dn]

dn

The dn to get

## COMMAND 'dsidm uniquegroup create'
usage: dsidm [-v] [-j] instance uniquegroup create [-h] [--cn [CN]]

## OPTIONS 'dsidm uniquegroup create'
--cn [CN]

Value of cn

## COMMAND 'dsidm uniquegroup delete'
usage: dsidm [-v] [-j] instance uniquegroup delete [-h] [dn]

dn

The dn to delete

## COMMAND 'dsidm uniquegroup modify'
usage: dsidm [-v] [-j] instance uniquegroup modify [-h] selector changes [changes ...]

selector

The cn to modify

changes

A list of changes to apply in format: <add|delete|replace>:<attribute>:<value>

## COMMAND 'dsidm uniquegroup rename'
usage: dsidm [-v] [-j] instance uniquegroup rename [-h] [--keep-old-rdn]

selector new_name

selector

The cn to rename

new_name

A new group name

## OPTIONS 'dsidm uniquegroup rename'
--keep-old-rdn

Specify whether the old RDN (i.e. 'cn: old_group') should be kept as an attribute of the entry or not

## COMMAND 'dsidm uniquegroup members'
usage: dsidm [-v] [-j] instance uniquegroup members [-h] [cn]

cn

cn of group to list members of

## COMMAND 'dsidm uniquegroup add_member'
usage: dsidm [-v] [-j] instance uniquegroup add_member [-h] [cn] [dn]

cn

cn of group to add member to

dn

dn of object to add to group as member

## COMMAND 'dsidm uniquegroup remove_member'
usage: dsidm [-v] [-j] instance uniquegroup remove_member [-h] [cn] [dn]

cn

cn of group to remove member from

dn

dn of object to remove from group as member

## OPTIONS
-v, --verbose

Display verbose operation tracing during command execution

-j, --json

Return result in JSON object

-b BASEDN, --basedn BASEDN

Base DN (root naming context) of the instance to manage

-D BINDDN, --binddn BINDDN

The account to bind as for executing operations

-w BINDPW, --bindpw BINDPW

Password for the bind DN

-W, --prompt

Prompt for password of the bind DN

-y PWDFILE, --pwdfile PWDFILE

Specifies a file containing the password of the bind DN

-Z, --starttls

Connect with StartTLS

## AUTHOR

```
"Red Hat, Inc., and William Brown" <389-devel@lists.fedoraproject.org>
```


title: pcs_snmp_agent(8)

text:
# pcs_snmp_agent(8)

## NAME
pcs_snmp_agent - a SNMP agent providing data about a corosync/pacemaker cluster

## DESCRIPTION
pcs_snmp_agent is a SNMP agent which connects to the master agent (snmpd) via agentx protocol and provides information about a corosync/pacemaker cluster.

## SETUP
pcs_snmp_agent doesn't work as a standalone agent. It only provides data to a master agent. To configure a snmpd daemon (from package net-snmp) as the master agent, add line 'master agentx' into the snmpd configuration file (see snmp.conf(5)). Then master agent has to be configured to accepts requests for pcs defined MIBs. This can be done by adding line 'view systemview included .1.3.6.1.4.1.32723.100' into the snmpd config file.

## MIB DATA VERSIONS
V1 - REDHAT-CLUSTER-PCS-V1-MIB

Provides basic information about cluster such as cluster name, list of cluster nodes and list of primitive resources.

## ENVIRONMENT
PCS_SNMP_AGENT_DEBUG=<boolean>

Set to true for advanced debugging information.

PCS_SNMP_AGENT_UPDATE_INTERVAL=<integer>

Time interval in seconds after which agent will update provided data.

## SEE ALSO
pcs(8) pcsd(8)

snmpd(8) snmp.conf(5)


qemu-ga

package: qemu-guest-agent

title: qemu-ga(8)

summary: QEMU Guest Agent

text:
# qemu-ga(8)

## NAME
qemu-ga - QEMU Guest Agent

## SYNOPSIS
qemu-ga [OPTIONS]

## DESCRIPTION
The QEMU Guest Agent is a daemon intended to be run within virtual machines. It allows the hypervisor host to perform various operations in the guest, such as:

- get information from the guest

- set the guest's system time

- read/write a file

- sync and freeze the filesystems

- suspend the guest

- reconfigure guest local processors

- set user's password

- ...

qemu-ga will read a system configuration file on startup (located at /etc/qemu/qemu-ga.conf by default), then parse remaining configuration options on the command line. For the same key, the last option wins, but the lists accumulate (see below for configuration file format).

If an allowed RPCs list is defined in the configuration, then all RPCs will be blocked by default, except for the allowed list.

If a blocked RPCs list is defined in the configuration, then all RPCs will be allowed by default, except for the blocked list.

If both allowed and blocked RPCs lists are defined in the configuration, then all RPCs will be blocked by default, then the allowed list will be applied, followed by the blocked list.

While filesystems are frozen, all except for a designated safe set of RPCs will blocked, regardless of what the general configuration declares.

## OPTIONS
-c, --config=PATH

Configuration file path (the default is /etc/qemu/qemu-ga.conf, unless overridden by the QGA_CONF environment variable)

-m, --method=METHOD

Transport method: one of unix-listen, virtio-serial, or isa-serial, or vsock-listen (virtio-serial is the default).

-p, --path=PATH

Device/socket path (the default for virtio-serial is /dev/virtio-ports/org.qemu.guest_agent.0, the default for isa-serial is /dev/ttyS0). Socket addresses for vsock-listen are written as <cid>:<port>.

-l, --logfile=PATH

Set log file path (default is stderr).

-f, --pidfile=PATH

Specify pid file (default is /var/run/qemu-ga.pid).

-F, --fsfreeze-hook=PATH

Enable fsfreeze hook. Accepts an optional argument that specifies script to run on freeze/thaw. Script will be called with 'freeze'/'thaw' arguments accordingly (default is /etc/qemu/fsfreeze-hook). If using -F with an argument, do not follow -F with a space (for example: -F/var/run/fsfreezehook.sh).

-t, --statedir=PATH

Specify the directory to store state information (absolute paths only, default is /var/run).

-v, --verbose

Log extra debugging information.

-V, --version

Print version information and exit.

-d, --daemon

Daemonize after startup (detach from terminal).

-b, --block-rpcs=LIST

Comma-separated list of RPCs to disable (no spaces, use --block-rpcs=help to list available RPCs).

-a, --allow-rpcs=LIST

Comma-separated list of RPCs to enable (no spaces, use --allow-rpcs=help to list available RPCs).

-D, --dump-conf

Dump the configuration in a format compatible with qemu-ga.conf and exit.

-h, --help

Display this help and exit.

## FILES
The syntax of the qemu-ga.conf configuration file follows the Desktop Entry Specification, here is a quick summary: it consists of groups of key-value pairs, interspersed with comments.

```
# qemu-ga configuration sample
[general]
daemonize = 0
pidfile = /var/run/qemu-ga.pid
verbose = 0
method = virtio-serial
path = /dev/virtio-ports/org.qemu.guest_agent.0
statedir = /var/run
```

The list of keys follows the command line options:

Key

Key type

daemon

boolean

method

string

path

string

logfile

string

pidfile

string

fsfreeze-hook

string

statedir

string

verbose

boolean

block-rpcs

string list

allow-rpcs

string list

## SEE ALSO
qemu(1)

## AUTHOR
Michael Roth <mdroth@linux.vnet.ibm.com>

## COPYRIGHT
2024, The QEMU Project Developers


qemu-nbd

package: qemu-img

title: qemu-nbd(8)

summary: QEMU Disk Network Block Device Server

text:
# qemu-nbd(8)

## NAME
qemu-nbd - QEMU Disk Network Block Device Server

## SYNOPSIS
qemu-nbd [OPTION]... filename

qemu-nbd -L [OPTION]...

qemu-nbd -d dev

## DESCRIPTION
Export a QEMU disk image using the NBD protocol.

Other uses:

- Bind a /dev/nbdX block device to a QEMU server (on Linux).

- As a client to query exports of a remote NBD server.

## OPTIONS
filename is a disk image filename, or a set of block driver options if --image-opts is specified.

dev is an NBD device.

--object type,id=ID,...

Define a new instance of the type object class identified by ID. See the qemu(1) manual page for full details of the properties supported. The common object types that it makes sense to define are the secret object, which is used to supply passwords and/or encryption keys, and the tls-creds object, which is used to supply TLS credentials for the qemu-nbd server or client.

-p, --port=PORT

TCP port to listen on as a server, or connect to as a client (default 10809).

-o, --offset=OFFSET

The offset into the image.

-b, --bind=IFACE

The interface to bind to as a server, or connect to as a client (default 0.0.0.0).

-k, --socket=PATH

Use a unix socket with path PATH.

--image-opts

Treat filename as a set of image options, instead of a plain filename. If this flag is specified, the -f flag should not be used, instead the format= option should be set.

-f, --format=FMT

Force the use of the block driver for format FMT instead of auto-detecting.

-r, --read-only

Export the disk as read-only.

-A, --allocation-depth

Expose allocation depth information via the qemu:allocation-depth metadata context accessible through NBD_OPT_SET_META_CONTEXT.

-B, --bitmap=NAME

If filename has a qcow2 persistent bitmap NAME, expose that bitmap via the qemu:dirty-bitmap:NAME metadata context accessible through NBD_OPT_SET_META_CONTEXT.

-s, --snapshot

Use filename as an external snapshot, create a temporary file with backing_file=filename, redirect the write to the temporary one.

-l, --load-snapshot=SNAPSHOT_PARAM

Load an internal snapshot inside filename and export it as an read-only device, SNAPSHOT_PARAM format is snapshot.id=[ID],snapshot.name=[NAME] or [ID_OR_NAME]

--cache=CACHE

The cache mode to be used with the file. Valid values are: none, writeback (the default), writethrough, directsync and unsafe. See the documentation of the emulator's -drive cache=... option for more info.

-n, --nocache

Equivalent to --cache=none.

--aio=AIO

Set the asynchronous I/O mode between threads (the default), native (Linux only), and io_uring (Linux 5.1+).

--discard=DISCARD

Control whether discard (also known as trim or unmap) requests are ignored or passed to the filesystem. DISCARD is one of ignore (or off), unmap (or on). The default is ignore.

--detect-zeroes=DETECT_ZEROES

Control the automatic conversion of plain zero writes by the OS to driver-specific optimized zero write commands. DETECT_ZEROES is one of off, on, or unmap. unmap converts a zero write to an unmap operation and can only be used if DISCARD is set to unmap. The default is off.

-c, --connect=DEV

Connect filename to NBD device DEV (Linux only).

-d, --disconnect

Disconnect the device DEV (Linux only).

-e, --shared=NUM

Allow up to NUM clients to share the device (default 1), 0 for unlimited.

-t, --persistent

Don't exit on the last connection.

-x, --export-name=NAME

Set the NBD volume export name (default of a zero-length string).

-D, --description=DESCRIPTION

Set the NBD volume export description, as a human-readable string.

-L, --list

Connect as a client and list all details about the exports exposed by a remote NBD server. This enables list mode, and is incompatible with options that change behavior related to a specific export (such as --export-name, --offset, ...).

--tls-creds=ID

Enable mandatory TLS encryption for the server by setting the ID of the TLS credentials object previously created with the --object option; or provide the credentials needed for connecting as a client in list mode.

--tls-hostname=hostname

When validating an x509 certificate received over a TLS connection, the hostname that the NBD client used to connect will be checked against information in the server provided certificate. Sometimes it might be required to override the hostname used to perform this check. For example, if the NBD client is using a tunnel from localhost to connect to the remote server, the --tls-hostname option should be used to set the officially expected hostname of the remote NBD server. This can also be used if accessing NBD over a UNIX socket where there is no inherent hostname available. This is only permitted when acting as a NBD client with the --list option.

--fork

Fork off the server process and exit the parent once the server is running.

--pid-file=PATH

Store the server's process ID in the given file.

--tls-authz=ID

Specify the ID of a qauthz object previously created with the --object option. This will be used to authorize connecting users against their x509 distinguished name.

-v, --verbose

Display extra debugging information. This option also keeps the original STDERR stream open if the qemu-nbd process is daemonized due to other options like --fork or -c.

-h, --help

Display this help and exit.

-V, --version

Display version information and exit.

-T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]

Specify tracing options. [enable=]PATTERN

Immediately enable events matching PATTERN (either event name or a globbing pattern). This option is only available if QEMU has been compiled with the simple, log or ftrace tracing backend. To specify multiple events or patterns, specify the -trace option multiple times. Use -trace help to print a list of names of trace points.

events=FILE

Immediately enable events listed in FILE. The file must contain one event name (as listed in the trace-events-all file) per line; globbing patterns are accepted too. This option is only available if QEMU has been compiled with the simple, log or ftrace tracing backend.

file=FILE

Log output traces to FILE. This option is only available if QEMU has been compiled with the simple tracing backend.

## EXAMPLES
Start a server listening on port 10809 that exposes only the guest-visible contents of a qcow2 file, with no TLS encryption, and with the default export name (an empty string). The command is one-shot, and will block until the first successful client disconnects:

```
qemu-nbd -f qcow2 file.qcow2
```

Start a long-running server listening with encryption on port 10810, and allow clients with a specific X.509 certificate to connect to a 1 megabyte subset of a raw file, using the export name 'subset':

```
qemu-nbd \

  --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \

  --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\

            O=Example Org,,L=London,,ST=London,,C=GB' \

  --tls-creds tls0 --tls-authz auth0 \

  -t -x subset -p 10810 \

  --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw
```

Serve a read-only copy of a guest image over a Unix socket with as many as 5 simultaneous readers, with a persistent process forked as a daemon:

```
qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \

  --read-only --format=qcow2 file.qcow2
```

Expose the guest-visible contents of a qcow2 file via a block device /dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for partitions found within), then disconnect the device when done. Access to bind qemu-nbd to a /dev/nbd device generally requires root privileges, and may also require the execution of modprobe nbd to enable the kernel NBD client module. CAUTION: Do not use this method to mount filesystems from an untrusted guest image - a malicious guest may have prepared the image to attempt to trigger kernel bugs in partition probing or file system mounting.

```
qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
qemu-nbd -d /dev/nbd0
```

Query a remote server to see details about what export(s) it is serving on port 10809, and authenticating via PSK:

```
qemu-nbd \

  --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \

  --tls-creds tls0 -L -b remote.example.com
```

## SEE ALSO
qemu(1), qemu-img(1)

## AUTHOR
Anthony Liguori <anthony@codemonkey.ws>

## COPYRIGHT
2024, The QEMU Project Developers


qemu-pr-helper

package: qemu-pr-helper

title: qemu-pr-helper(8)

summary: QEMU persistent reservation helper

text:
# qemu-pr-helper(8)

## NAME
qemu-pr-helper - QEMU persistent reservation helper

## SYNOPSIS
qemu-pr-helper [OPTION]

## DESCRIPTION
Implements the persistent reservation helper for QEMU.

SCSI persistent reservations allow restricting access to block devices to specific initiators in a shared storage setup. When implementing clustering of virtual machines, it is a common requirement for virtual machines to send persistent reservation SCSI commands. However, the operating system restricts sending these commands to unprivileged programs because incorrect usage can disrupt regular operation of the storage fabric. QEMU's SCSI passthrough devices scsi-block and scsi-generic support passing guest persistent reservation requests to a privileged external helper program. qemu-pr-helper is that external helper; it creates a listener socket which will accept incoming connections for communication with QEMU.

If you want to run VMs in a setup like this, this helper should be started as a system service, and you should read the QEMU manual section on "persistent reservation managers" to find out how to configure QEMU to connect to the socket created by qemu-pr-helper.

After connecting to the socket, qemu-pr-helper can optionally drop root privileges, except for those capabilities that are needed for its operation.

qemu-pr-helper can also use the systemd socket activation protocol. In this case, the systemd socket unit should specify a Unix stream socket, like this:

```
[Socket]
ListenStream=/var/run/qemu-pr-helper.sock
```

## OPTIONS
-d, --daemon

run in the background (and create a PID file)

-q, --quiet

decrease verbosity

-v, --verbose

increase verbosity

-f, --pidfile=PATH

PID file when running as a daemon. By default the PID file is created in the system runtime state directory, for example /var/run/qemu-pr-helper.pid.

-k, --socket=PATH

path to the socket. By default the socket is created in the system runtime state directory, for example /var/run/qemu-pr-helper.sock.

-T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]

Specify tracing options. [enable=]PATTERN

Immediately enable events matching PATTERN (either event name or a globbing pattern). This option is only available if QEMU has been compiled with the simple, log or ftrace tracing backend. To specify multiple events or patterns, specify the -trace option multiple times. Use -trace help to print a list of names of trace points.

events=FILE

Immediately enable events listed in FILE. The file must contain one event name (as listed in the trace-events-all file) per line; globbing patterns are accepted too. This option is only available if QEMU has been compiled with the simple, log or ftrace tracing backend.

file=FILE

Log output traces to FILE. This option is only available if QEMU has been compiled with the simple tracing backend.

-u, --user=USER

user to drop privileges to

-g, --group=GROUP

group to drop privileges to

-h, --help

Display a help message and exit.

-V, --version

Display version information and exit.

## COPYRIGHT
2024, The QEMU Project Developers


qphotorec

package: qphotorec

title: qphotorec(8)

text:
# qphotorec(8)

## NAME
qphotorec - Recover lost files from harddisk, digital camera and cdrom

## SYNOPSIS
qphotorec

## DESCRIPTION

QPhotoRec is a GUI file data recovery software designed to recover lost files including video, documents and archives from Hard Disks and CDRom and lost pictures (Photo Recovery) from digital camera memory. QPhotoRec ignores the filesystem and goes after the underlying data, so it'll work even if your media's filesystem is severely damaged or formatted. PhotoRec is safe to use, it will never attempt to write to the drive or memory support you are about to recover lost data from.

For more information on how to use, please visit the wiki pages on www.cgsecurity.org

## SEE ALSO
photorec(8), testdisk(8), fdisk(8).

## AUTHOR
QPhotoRec 7.2, Data Recovery Utility, February 2024

Christophe GRENIER <grenier@cgsecurity.org>

https://www.cgsecurity.org


convertquota

package: quota

title: convertquota(8)

text:
# convertquota(8)

## NAME
convertquota - convert quota from old file format to new one

## SYNOPSIS
convertquota [ -ug ] -e filesystem

convertquota [ -ug ] -f oldformat,newformat filesystem

## DESCRIPTION
convertquota converts old quota files quota.user and quota.group to files aquota.user and aquota.group in new format currently used by 2.4.0-ac? and newer or by SuSE or Red Hat Linux 2.4 kernels on filesystem.

New file format allows using quotas for 32-bit uids / gids, setting quotas for root, accounting used space in bytes (and so allowing use of quotas in ReiserFS) and it is also architecture independent. This format introduces Radix Tree (a simple form of tree structure) to quota file.

## OPTIONS
-u, --user

convert user quota file. This is the default.

-g, --group

convert group quota file.

-f, --convert-format oldformat,newformat

convert quota file from oldformat to newformat.

-e, --convert-endian

convert vfsv0 file format from big endian to little endian (old kernels had a bug and did not store quota files in little endian format).

-V, --version

print version information.

## FILES
aquota.user

new user quota file

aquota.group

new group quota file

## SEE ALSO
quota(1), setquota(8), edquota(8), quotacheck(8), quotaon(8), repquota(8)

## AUTHOR
Jan Kara <jack@suse.cz>


edquota

title: edquota(8)

summary: edit user quotas

text:
# edquota(8)

## NAME
edquota - edit user quotas

## SYNOPSIS
edquota [ -p protoname ] [ -u | -g | -P ] [ -rm ] [ -F format-name ] [ -f filesystem ] username | groupname | projectname...

edquota [ -u | -g | -P ] [ -F format-name ] [ -f filesystem ] -t

edquota [ -u | -g | -P ] [ -F format-name ] [ -f filesystem ] -T username | groupname | projectname...

## DESCRIPTION
edquota is a quota editor. One or more users, groups, or projects may be specified on the command line. If a number is given in the place of user/group/project name it is treated as an UID/GID/Project ID. For each user, group, or project a temporary file is created with an ASCII representation of the current disk quotas for that user, group, or project and an editor is then invoked on the file. The quotas may then be modified, new quotas added, etc. Setting a quota to zero indicates that no quota should be imposed.

Block usage and limits are reported and interpreted as multiples of kibibyte (1024 bytes) blocks by default. Symbols K, M, G, and T can be appended to numeric value to express kibibytes, mebibytes, gibibytes, and tebibytes.

Inode usage and limits are interpreted literally. Symbols k, m, g, and t can be appended to numeric value to express multiples of 10^3, 10^6, 10^9, and 10^12 inodes.

Users are permitted to exceed their soft limits for a grace period that may be specified per filesystem. Once the grace period has expired, the soft limit is enforced as a hard limit.

The current usage information in the file is for informational purposes; only the hard and soft limits can be changed.

Upon leaving the editor, edquota reads the temporary file and modifies the binary quota files to reflect the changes made.

The editor invoked is vitmp(1) unless either the EDITOR or the VISUAL environment variable specifies otherwise.

Only the super-user may edit quotas.

## OPTIONS
-r, --remote

Edit also non-local quota use rpc.rquotad on remote server to set quota. This option is available only if quota tools were compiled with enabled support for setting quotas over RPC. The -n option is equivalent, and is maintained for backward compatibility.

-m, --no-mixed-pathnames

Currently, pathnames of NFSv4 mountpoints are sent without leading slash in the path. rpc.rquotad uses this to recognize NFSv4 mounts and properly prepend pseudoroot of NFS filesystem to the path. If you specify this option, edquota will always send paths with a leading slash. This can be useful for legacy reasons but be aware that quota over RPC will stop working if you are using new rpc.rquotad.

-u, --user

Edit the user quota. This is the default.

-g, --group

Edit the group quota.

-P, --project

Edit the project quota.

-p, --prototype=protoname

Duplicate the quotas of the prototypical user specified for each user specified. This is the normal mechanism used to initialize quotas for groups of users.

--always-resolve

Always try to translate user / group name to uid / gid even if the name is composed of digits only.

-F, --format=format-name

Edit quota for specified format (ie. don't perform format autodetection). Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, rpc (quota over NFS), xfs (quota on XFS filesystem)

-f, --filesystem filesystem

Perform specified operations only for given filesystem (default is to perform operations for all filesystems with quota).

-t, --edit-period

Edit the soft time limits for each filesystem. In old quota format if the time limits are zero, the default time limits in <linux/quota.h> are used. In new quota format time limits must be specified (there is no default value set in kernel). Time units of 'seconds', 'minutes', 'hours', and 'days' are understood. Time limits are printed in the greatest possible time unit such that the value is greater than or equal to one.

-T, --edit-times

Edit time for the user/group/project when softlimit is enforced. Possible values are 'unset' or number and unit. Units are the same as in -t option.

## FILES
aquota.user or aquota.group

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user or quota.group

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/mtab

mounted filesystems table

## SEE ALSO
quota(1), vitmp(1), quotactl(2), quotacheck(8), quotaon(8), repquota(8), setquota(8)


quotacheck

title: quotacheck(8)

text:
# quotacheck(8)

## NAME
quotacheck - scan a filesystem for disk usage, create, check and repair quota files

## SYNOPSIS
quotacheck [ -gubcfinvdMmR ] [ -F quota-format ] -a | filesystem

## DESCRIPTION
quotacheck examines each filesystem, builds a table of current disk usage, and compares this table against that recorded in the disk quota file for the filesystem (this step is omitted if option -c is specified). If any inconsistencies are detected, both the quota file and the current system copy of the incorrect quotas are updated (the latter only occurs if an active filesystem is checked which is not advised). By default, only user quotas are checked. quotacheck expects each filesystem to be checked to have quota files named [a]quota.user and [a]quota.group located at the root of the associated filesystem. If a file is not present, quotacheck will create it.

If the quota file is corrupted, quotacheck tries to save as much data as possible. Rescuing data may need user intervention. With no additional options quotacheck will simply exit in such a situation. When in interactive mode (option -i) , the user is asked for advice. Advice can also be provided from command line (see option -n) , which is useful when quotacheck is run automatically (ie. from script) and failure is unacceptable.

quotacheck should be run each time the system boots and mounts non-valid filesystems. This is most likely to happen after a system crash.

It is strongly recommended to run quotacheck with quotas turned off for the filesystem. Otherwise, possible damage or loss to data in the quota files can result. It is also unwise to run quotacheck on a live filesystem as actual usage may change during the scan. To prevent this, quotacheck tries to remount the filesystem read-only before starting the scan. After the scan is done it remounts the filesystem read-write. You can disable this with option -m. You can also make quotacheck ignore the failure to remount the filesystem read-only with option -M.

## OPTIONS
-b, --backup

Forces quotacheck to make backups of the quota file before writing the new data.

-v, --verbose

quotacheck reports its operation as it progresses. Normally it operates silently. If the option is specified twice, also the current directory is printed (note that printing can slow down the scan measurably).

-d, --debug

Enable debugging mode. It will result in a lot of information which can be used in debugging the program. The output is very verbose and the scan will be slow.

-u, --user

Only user quotas listed in /etc/mtab or on the filesystems specified are to be checked. This is the default action.

-g, --group

Only group quotas listed in /etc/mtab or on the filesystems specified are to be checked.

-c, --create-files

Don't read existing quota files. Just perform a new scan and save it to disk. quotacheck also skips scanning of old quota files when they are not found.

-f, --force

Forces checking and writing of new quota files on filesystems with quotas enabled. This is not recommended as the created quota files may be out of sync.

-M, --try-remount

This flag forces checking of filesystem in read-write mode if a remount fails. Do this only when you are sure no process will write to a filesystem while scanning.

-m, --no-remount

Don't try to remount filesystem read-only. See comment with option -M.

-i, --interactive

Interactive mode. By default quotacheck exits when it finds an error. In interactive mode user is asked for input instead. See option -n.

-n, --use-first-dquot

If the quota files become corrupted, it is possible for duplicate entries for a single user or group ID to exist. Normally in this case, quotacheck exits or asks user for input. When this option is set, the first entry found is always used (this option works in interactive mode too).

-F, --format=format-name

Check and fix quota files of specified format (ie. don't perform format auto-detection). This is recommended as detection might not work well on corrupted quota files. Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, rpc (quota over NFS), xfs (quota on XFS filesystem)

-a, --all

Check all mounted non-NFS filesystems in /etc/mtab

-R, --exclude-root

When used together with the -a option, all filesystems except for the root filesystem are checked for quotas.

## NOTE
quotacheck should only be run by super-user. Non-privileged users are presumably not allowed to read all the directories on the given filesystem.

## SEE ALSO
quota(1), quotactl(2), fstab(5), quotaon(8), repquota(8), convertquota(8), setquota(8), edquota(8), fsck(8), efsck(8), e2fsck(8), xfsck(8)

## FILES
aquota.user or aquota.group

located at filesystem root with quotas (version 2 quota, non-XFS filesystems)

quota.user or quota.group

located at filesystem root with quotas (version 1 quota, non-XFS filesystems)

/etc/mtab

names and locations of mounted filesystems

## AUTHOR
Jan Kara <jack@suse.cz>

Based on old quotacheck by:

Edvard Tuinder <ed@elm.net>

Marco van Wieringen <mvw@planets.elm.net>


quotaon

title: quotaon(8)

summary: turn filesystem quotas on and off

text:
# quotaon(8)

## NAME
quotaon, quotaoff - turn filesystem quotas on and off

## SYNOPSIS
quotaon [ -vugfp ] [ -F format-name ] filesystem...

quotaon [ -avugPfp ] [ -F format-name ]

quotaoff [ -vugPp ] [ -x state ] filesystem...

quotaoff [ -avugp ]

## DESCRIPTION

### quotaon
quotaon announces to the system that disk quotas should be enabled on one or more filesystems. The filesystem quota files must be present in the root directory of the specified filesystem and be named either aquota.user (for version 2 user quota), quota.user (for version 1 user quota), aquota.group (for version 2 group quota), or quota.group (for version 1 group quota).

XFS filesystems are a special case - XFS considers quota information as filesystem metadata and uses journaling to provide a higher level guarantee of consistency. There are two components to the XFS disk quota system: accounting and limit enforcement. XFS filesystems require that quota accounting be turned on at mount time. It is possible to enable and disable limit enforcement on an XFS filesystem after quota accounting is already turned on. The default is to turn on both accounting and enforcement.

The XFS quota implementation does not maintain quota information in user-visible files, but rather stores this information internally.

### quotaoff
quotaoff announces to the system that the specified filesystems should have any disk quotas turned off.

## OPTIONS

### quotaon
-F, --format=format-name

Report quota for specified format (ie. don't perform format autodetection). Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, xfs (quota on XFS filesystem)

-a, --all

All automatically mounted (no noauto option) non-NFS filesystems in /etc/fstab with quotas will have their quotas turned on. This is normally used at boot time to enable quotas.

-v, --verbose

Display a message for each filesystem where quotas are turned on.

-u, --user

Manipulate user quotas. This is the default.

-g, --group

Manipulate group quotas.

-P, --project

Manipulate project quotas.

-p, --print-state

Instead of turning quotas on just print state of quotas (ie. whether. quota is on or off)

-x, --xfs-command enforce

Switch on limit enforcement for XFS filesystems. This is the default action for any XFS filesystem. This option is only applicable to XFS, and is silently ignored for other filesystem types.

-f, --off

Make quotaon behave like being called as quotaoff.

### quotaoff
-F, --format=format-name

Report quota for specified format (ie. don't perform format autodetection). Possible format names are: vfsold (version 1 quota), vfsv0 (version 2 quota), xfs (quota on XFS filesystem)

-a, --all

Force all filesystems in /etc/fstab to have their quotas disabled.

-v, --verbose

Display a message for each filesystem affected.

-u, --user

Manipulate user quotas. This is the default.

-g, --group

Manipulate group quotas.

-P, --project

Manipulate project quotas.

-p, --print-state

Instead of turning quotas off just print state of quotas (ie. whether. quota is on or off)

-x, --xfs-command delete

Free up the space used to hold quota information (maintained internally) within XFS. This option is only applicable to XFS, and is silently ignored for other filesystem types. It can only be used on a filesystem with quota previously turned off.

-x, --xfs-command enforce

Switch off limit enforcement for XFS filesystems (perform quota accounting only). This is the default action for any XFS filesystem. This option is only applicable to XFS, and is silently ignored for other filesystem types.

-x, --xfs-command account

This option can be used to disable quota accounting. It is not possible to enable quota accounting by quota tools. Use mount(8) for that. This option is only applicable to XFS filesystems, and is silently ignored for other filesystem types.

## NOTES ON XFS FILESYSTEMS
To enable quotas on an XFS filesystem, use mount(8) or /etc/fstab quota option to enable both accounting and limit enforcement. quotaon utility cannot be used for this purpose.

Turning on quotas on an XFS root filesystem requires the quota mount options be passed into the kernel at boot time through the Linux rootflags boot option.

To turn off quota limit enforcement on any XFS filesystem, first make sure that quota accounting and enforcement are both turned on using repquota -v filesystem. Then, use quotaoff -v filesystem to disable limit enforcement. This may be done while the filesystem is mounted.

Turning on quota limit enforcement on an XFS filesystem is achieved using quotaon -v filesystem. This may be done while the filesystem is mounted.

## FILES
aquota.user or aquota.group

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user or quota.group

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/fstab

default filesystems

## SEE ALSO
quotactl(2), fstab(5), quota_nld(8), repquota(8), warnquota(8)


quotastats

title: quotastats(8)

summary: Program to query quota statistics

text:
# quotastats(8)

## NAME
quotastats - Program to query quota statistics

## SYNOPSIS
/usr/sbin/quotastats

## DESCRIPTION
quotastats queries the kernel for quota statistics. It displays:

•

Supported kernel quota version

•

Number of dquot lookups

•

Number of dquot drops

•

Number of dquot reads

•

Number of dquot writes

•

Number of quotafile syncs

•

Number of dquot cache hits

•

Number of allocated dquots

•

Number of free dquots

•

Number of in use dquot entries (user/group)

## OPTIONS
None.

## SEE ALSO
quota(1).


repquota

title: repquota(8)

summary: summarize quotas for a filesystem

text:
# repquota(8)

## NAME
repquota - summarize quotas for a filesystem

## SYNOPSIS
/usr/sbin/repquota [ -vspiugP ] [ -c | -C ] [ -t | -n ] [ -F format-name ] filesystem...

/usr/sbin/repquota [ -avtpsiugP ] [ -c | -C ] [ -t | -n ] [ -F format-name ]

## DESCRIPTION
repquota prints a summary of the disc usage and quotas for the specified file systems. For each user the current number of files and amount of space (in kilobytes) is printed, along with any quota limits set with edquota(8) or setquota(8). In the second column repquota prints two characters marking which limits are exceeded. If user is over his space softlimit or reaches his space hardlimit in case softlimit is unset, the first character is '+'. Otherwise the character printed is '-'. The second character denotes the state of inode usage analogously.

repquota has to translate ids of all users/groups/projects to names (unless option -n was specified) so it may take a while to print all the information. To make translating as fast as possible repquota tries to detect (by reading /etc/nsswitch.conf) whether entries are stored in standard plain text file or in a database and either translates chunks of 1024 names or each name individually. You can override this autodetection by -c or -C options.

## OPTIONS
-a, --all

Report on all filesystems indicated in /etc/mtab to be read-write with quotas.

-v, --verbose

Report all quotas, even if there is no usage. Be also more verbose about quotafile information.

-c, --cache

Cache entries to report and translate uids/gids to names in big chunks by scanning all users (default). This is good (fast) behaviour when using /etc/passwd file.

-C, --no-cache

Translate individual entries. This is faster when you have users stored in database.

-t, --truncate-names

Truncate user/group names longer than 9 characters. This results in nicer output when there are such names.

-n, --no-names

Don't resolve UIDs/GIDs to names. This can speedup printing a lot.

-s, --human-readable[=units]

Try to report used space, number of used inodes and limits in more appropriate units than the default ones. Units can be also specified explicitely by an optional argument in format [ kgt ],[ kgt ] where the first character specifies space units and the second character specifies inode units.

-p, --raw-grace

When user is in grace period, report time in seconds since epoch when his grace time runs out (or has run out). Field is '0' when no grace time is in effect. This is especially useful when parsing output by a script.

-i, --no-autofs

Ignore mountpoints mounted by automounter.

-F, --format=format-name

Report quota for specified format (ie. don't perform format autodetection). Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, xfs (quota on XFS filesystem)

-g, --group

Report quotas for groups.

-P, --project

Report quotas for projects.

-u, --user

Report quotas for users. This is the default.

-O, --output=format-name

Output quota report in the specified format. Possible format names are: default The default format, optimized for console viewing csv Comma-separated values, a text file with the columns delimited by commas xml Output is XML encoded, useful for processing with XSLT

Only the super-user may view quotas which are not their own.

## FILES
aquota.user or aquota.group

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user or quota.group

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/mtab

default filesystems

/etc/passwd

default set of users

/etc/group

default set of groups

## SEE ALSO
quota(1), quotactl(2), edquota(8), quotacheck(8), quotaon(8), quota_nld(8), setquota(8), warnquota(8)


setquota

title: setquota(8)

summary: set disk quotas

text:
# setquota(8)

## NAME
setquota - set disk quotas

## SYNOPSIS
setquota [ -rm ] [ -u | -g | -P ] [ -F quotaformat ] name block-softlimit block-hardlimit inode-softlimit inode-hardlimit -a | filesystem...

setquota [ -rm ] [ -u | -g | -P ] [ -F quotaformat ] [ -p protoname ] name -a | filesystem...

setquota -b [ -rm ] [ -u | -g | -P ] [ -F quotaformat ] -a | filesystem...

setquota -t [ -u | -g | -P ] [ -F quotaformat ] block-grace inode-grace -a | filesystem...

setquota -T [ -u | -g | -P ] [ -F quotaformat ] name block-grace inode-grace -a | filesystem...

## DESCRIPTION
setquota is a command line quota editor. The filesystem, user/group/project name and new quotas for this filesystem can be specified on the command line. Note that if a number is given in the place of a user/group/project name it is treated as an UID/GID/project ID.

-r, --remote

Edit also remote quota use rpc.rquotad on remote server to set quota. This option is available only if quota tools were compiled with enabled support for setting quotas over RPC.

-m, --no-mixed-pathnames

Currently, pathnames of NFSv4 mountpoints are sent without leading slash in the path. rpc.rquotad uses this to recognize NFSv4 mounts and properly prepend pseudoroot of NFS filesystem to the path. If you specify this option, setquota will always send paths with a leading slash. This can be useful for legacy reasons but be aware that quota over RPC will stop working if you are using new rpc.rquotad.

-F, --format=quotaformat

Perform setting for specified format (ie. don't perform format autodetection). Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, rpc (quota over NFS), xfs (quota on XFS filesystem)

-u, --user

Set user quotas for named user. This is the default.

-g, --group

Set group quotas for named group.

-P, --project

Set project quotas for named project.

-p, --prototype=protoname

Use quota settings of user, group or project protoname to set the quota for the named user, group or project.

--always-resolve

Always try to translate user / group / project name to uid / gid / project ID even if the name is composed of digits only.

-b, --batch

Read information to set from stdin (input format is name block-softlimit block-hardlimit inode-softlimit inode-hardlimit ). Empty lines and lines starting with # are ignored.

-c, --continue-batch

If parsing of an input line in batch mode fails, continue with processing the next line.

-t, --edit-period

Set grace times for users/groups/projects. Times block-grace and inode-grace are specified in seconds.

-T, --edit-times

Alter times for individual user/group/project when softlimit is enforced. Times block-grace and inode-grace are specified in seconds or can be string 'unset'.

-a, --all

Go through all filesystems with quota in /etc/mtab and perform setting.

block-softlimit and block-hardlimit are interpreted as multiples of kibibyte (1024 bytes) blocks by default. Symbols K, M, G, and T can be appended to numeric value to express kibibytes, mebibytes, gibibytes, and tebibytes.

inode-softlimit and inode-hardlimit are interpreted literally. Symbols k, m, g, and t can be appended to numeric value to express multiples of 10^3, 10^6, 10^9, and 10^12 inodes.

To disable a quota, set the corresponding parameter to 0. To change quotas for several filesystems, invoke once for each filesystem.

Only the super-user may edit quotas.

## FILES
aquota.user or aquota.group

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user or quota.group

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/mtab

mounted filesystem table

## SEE ALSO
edquota(8), quota(1), quotactl(2), quotacheck(8), quotaon(8), repquota(8)


warnquota

title: warnquota(8)

summary: send mail to users over quota

text:
# warnquota(8)

## NAME
warnquota - send mail to users over quota

## SYNOPSIS
warnquota [ -ugsid ] [ -F quotaformat ] [ -q quotatab ] [ -c configfile ] [ -a adminsfile ] [ filesystem... ]

## DESCRIPTION
warnquota checks the disk quota for specified local filesystems (or for each local filesystem if none specified) and mails a warning message to those users who have reached their softlimit. It is typically run via cron(8).

-F, --format=quotaformat

Perform setting for specified format (ie. don't perform format autodetection). Possible format names are: vfsold Original quota format with 16-bit UIDs / GIDs, vfsv0 Quota format with 32-bit UIDs / GIDs, 64-bit space usage, 32-bit inode usage and limits, vfsv1 Quota format with 64-bit quota limits and usage, xfs Quota on XFS filesystem.

-q, --quota-tab=quotatab

Use quotatab instead of /etc/quotatab as file with device description strings (see quotatab(5) for syntax).

-c, --config=configfile

Use configfile instead of /etc/warnquota.conf as configuration file (see warnquota.conf(5) for syntax).

-a, --admins-file=adminsfile

Use adminsfile instead of /etc/quotagrpadmins as a file with administrators of the groups (see quotagrpadmins(5) for syntax).

-u, --user

check whether users are not exceeding quotas (default).

-g, --group

check whether groups are not exceeding quotas. If group is exceeding quota a mail is sent to the user specified in /etc/quotagrpadmins.

-s, --human-readable[=units]

Try to report used space, number of used inodes and limits in more appropriate units than the default ones. Units can be also specified explicitely by an optional argument in format [ kgt ],[ kgt ] where the first character specifies space units and the second character specifies inode units.

-i, --no-autofs

ignore mountpoints mounted by automounter.

-d, --no-details

do not attach quota report in email.

## FILES
aquota.user

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/warnquota.conf

configuration file

/etc/quotatab

device description

/etc/quotagrpadmins

administrators of the groups

/etc/mtab

default filesystems

/etc/passwd

default set of users

## SEE ALSO
quota(1), quotatab(5), quotagrpadmins(5), warnquota.conf(5), cron(8), edquota(8).

## AUTHORS
warnquota(8) was written by Marco van Wieringen <mvw@planets.elm.net>, modifications by Jan Kara <jack@suse.cz>. This reference page written by Heiko Schlittermann <heiko@lotte.sax.de>, modifications by Jan Kara


xqmstats

title: xqmstats(8)

text:
# xqmstats(8)

## NAME
xqmstats - Display XFS quota manager statistics from /proc

## SYNOPSIS
/usr/sbin/xqmstats

## DESCRIPTION
xqmstat queries the kernel for the XFS Quota Manager dquot statistics. It displays:

•

Reclaims

•

Missed reclaims

•

Dquot dups

•

Cache misses

•

Cache hits

•

Dquot wants

•

Shake reclaims

•

Inact reclaims

## OPTIONS
None.

## SEE ALSO
quotastats(1), quota(1).


rpc.rquotad

package: quota-rpc

title: rpc.rquotad(8)

summary: remote quota server

text:
# rpc.rquotad(8)

## NAME
rpc.rquotad - remote quota server

## SYNOPSIS
/usr/sbin/rpc.rquotad [ -FI ] [ -p port ] [ -s | -S ] [ -x path ]

/usr/sbin/rpc.rquotad [ -h | -V ]

## DESCRIPTION
rpc.rquotad is an rpc(3) server which returns quotas for a user of a local filesystem which is mounted by a remote machine over the NFS. It also allows setting of quotas on NFS mounted filesystem (if configured during compilation and allowed by a command line option -S). The results are used by quota(1) to display user quotas for remote filesystems and by edquota(8) to set quotas on remote filesystems. rquotad daemon uses tcp-wrappers library (under service name rquotad) which allows you to specify hosts allowed/disallowed to use the daemon (see hosts.allow(5) manpage for more information). The rquotad daemon is normally started at boot time from the system startup scripts.

## OPTIONS
-h, --help

Show program usage and exit. -V, --version Show version of quota tools.

-s, --no-setquota

Don't allow setting of quotas (default). This option is available only if utilities were compiled with the rpcsetquota option.

-S, --setquota

Allow setting of quotas. This option is available only if utilities were compiled with the rpcsetquota option.

-F, --foreground

Run daemon in foreground (may be useful for debugging purposes).

-I, --autofs

Do not ignore autofs mountpoints.

-p port, --port port

Listen on alternate port port.

-x path, --xtab path

Set an alternative file with NFSD export table. This file is used to determine pseudoroot of NFSv4 exports. The pseudoroot is then prepended to each relative path (i.e. a path not beginning by '/') received in a quota RPC request.

## FILES
aquota.user or aquota.group

quota file at the filesystem root (version 2 quota, non-XFS filesystems)

quota.user or quota.group

quota file at the filesystem root (version 1 quota, non-XFS filesystems)

/etc/mtab

default filesystems

## SEE ALSO
quota(1), rpc(3), nfs(5), services(5), inetd(8)