agetty

package: agetty

title: agetty(8)

summary: alternative Linux getty

text:
# agetty(8)

## NAME
agetty - alternative Linux getty

## SYNOPSIS
agetty [options] port [baud_rate...] [term]

## DESCRIPTION
agetty opens a tty port, prompts for a login name and invokes the /bin/login command. It is normally invoked by init(8).

agetty has several non-standard features that are useful for hardwired and for dial-in lines:

•Adapts the tty settings to parity bits and to erase, kill, end-of-line and uppercase characters when it reads a login name. The program can handle 7-bit characters with even, odd, none or space parity, and 8-bit characters with no parity. The following special characters are recognized: Control-U (kill); DEL and backspace (erase); carriage return and line feed (end of line). See also the --erase-chars and --kill-chars options.

•Optionally deduces the baud rate from the CONNECT messages produced by Hayes(tm)-compatible modems.

•Optionally does not hang up when it is given an already opened line (useful for call-back applications).

•Optionally does not display the contents of the /etc/issue file.

•Optionally displays an alternative issue files or directories instead of /etc/issue or /etc/issue.d.

•Optionally does not ask for a login name.

•Optionally invokes a non-standard login program instead of /bin/login.

•Optionally turns on hardware flow control.

•Optionally forces the line to be local with no need for carrier detect.

This program does not use the /etc/gettydefs (System V) or /etc/gettytab (SunOS 4) files.

## ARGUMENTS
port

A path name relative to the /dev directory. If a "-" is specified, agetty assumes that its standard input is already connected to a tty port and that a connection to a remote user has already been established. Under System V, a "-" port argument should be preceded by a "--".

baud_rate,...

A comma-separated list of one or more baud rates. Each time agetty receives a BREAK character it advances through the list, which is treated as if it were circular. Baud rates should be specified in descending order, so that the null character (Ctrl-@) can also be used for baud-rate switching.

This argument is optional and unnecessary for virtual terminals.

The default for serial terminals is keep the current baud rate (see --keep-baud) and if unsuccessful then default to '9600'.

term

The value to be used for the TERM environment variable. This overrides whatever init(1) may have set, and is inherited by login and the shell. The default is 'vt100', or 'linux' for Linux on a virtual terminal, or 'hurd' for GNU Hurd on a virtual terminal.

## OPTIONS
-8, --8bits

Assume that the tty is 8-bit clean, hence disable parity detection.

-a, --autologin username

Automatically log in the specified user without asking for a username or password. Using this option causes an -f username option and argument to be added to the /bin/login command line. See --login-options, which can be used to modify this option’s behavior. Note that --autologin may affect the way in which getty initializes the serial line, because on auto-login agetty does not read from the line and it has no opportunity optimize the line setting.

-c, --noreset

Do not reset terminal cflags (control modes). See termios(3) for more details.

-E, --remote

Typically the login(1) command is given a remote hostname when called by something such as telnetd(8). This option allows agetty to pass what it is using for a hostname to login(1) for use in utmp(5). See --host, login(1), and utmp(5). If the --host fakehost option is given, then an -h fakehost option and argument are added to the /bin/login command line.

If the --nohostname option is given, then an -H option is added to the /bin/login command line.

See --login-options.

-f, --issue-file path

Specifies a ":" delimited list of files and directories to be displayed instead of /etc/issue (or other). All specified files and directories are displayed, missing or empty files are silently ignored. If the specified path is a directory then display all files with .issue file extension in version-sort order from the directory. This allows custom messages to be displayed on different terminals. The --noissue option will override this option.

--show-issue

Display the current issue file (or other) on the current terminal and exit. Use this option to review the current setting, it is not designed for any other purpose. Note that output may use some default or incomplete information as proper output depends on terminal and agetty command line.

-h, --flow-control

Enable hardware (RTS/CTS) flow control. It is left up to the application to disable software (XON/XOFF) flow protocol where appropriate.

-H, --host fakehost

Write the specified fakehost into the utmp file. Normally, no login host is given, since agetty is used for local hardwired connections and consoles. However, this option can be useful for identifying terminal concentrators and the like.

-i, --noissue

Do not display the contents of /etc/issue (or other) before writing the login prompt. Terminals or communications hardware may become confused when receiving lots of text at the wrong baud rate; dial-up scripts may fail if the login prompt is preceded by too much text.

-I, --init-string initstring

Set an initial string to be sent to the tty or modem before sending anything else. This may be used to initialize a modem. Non-printable characters may be sent by writing their octal code preceded by a backslash (\). For example, to send a linefeed character (ASCII 10, octal 012), write \12.

-J, --noclear

Do not clear the screen before prompting for the login name. By default the screen is cleared.

-l, --login-program login_program

Invoke the specified login_program instead of /bin/login. This allows the use of a non-standard login program. Such a program could, for example, ask for a dial-up password or use a different password file. See --login-options.

-L, --local-line[=mode]

Control the CLOCAL line flag. The optional mode argument is auto, always or never. If the mode argument is omitted, then the default is always. If the --local-line option is not given at all, then the default is auto. always

Forces the line to be a local line with no need for carrier detect. This can be useful when you have a locally attached terminal where the serial line does not set the carrier-detect signal.

never

Explicitly clears the CLOCAL flag from the line setting and the carrier-detect signal is expected on the line.

auto

The agetty default. Does not modify the CLOCAL setting and follows the setting enabled by the kernel.

-m, --extract-baud

Try to extract the baud rate from the CONNECT status message produced by Hayes(tm)-compatible modems. These status messages are of the form: "<junk><speed><junk>". agetty assumes that the modem emits its status message at the same speed as specified with (the first) baud_rate value on the command line. Since the --extract-baud feature may fail on heavily-loaded systems, you still should enable BREAK processing by enumerating all expected baud rates on the command line.

--list-speeds

Display supported baud rates. These are determined at compilation time.

-n, --skip-login

Do not prompt the user for a login name. This can be used in connection with the --login-program option to invoke a non-standard login process such as a BBS system. Note that with the --skip-login option, agetty gets no input from the user who logs in and therefore will not be able to figure out parity, character size, and newline processing of the connection. It defaults to space parity, 7 bit characters, and ASCII CR (13) end-of-line character. Beware that the program that agetty starts (usually /bin/login) is run as root.

-N, --nonewline

Do not print a newline before writing out /etc/issue.

-o, --login-options login_options

Options and arguments that are passed to login(1). Where \u is replaced by the login name. For example: --login-options '-h darkstar -- \u'

See --autologin, --login-program and --remote.

Please read the SECURITY NOTICE below before using this option.

-p, --login-pause

Wait for any key before dropping to the login prompt. Can be combined with --autologin to save memory by lazily spawning shells.

-r, --chroot directory

Change root to the specified directory.

-R, --hangup

Call vhangup(2) to do a virtual hangup of the specified terminal.

-s, --keep-baud

Try to keep the existing baud rate. The baud rates from the command line are used when agetty receives a BREAK character. If another baud rates specified then the original baud rate is also saved to the end of the wanted baud rates list. This can be used to return to the original baud rate after unexpected BREAKs.

-t, --timeout timeout

Terminate if no user name could be read within timeout seconds. Use of this option with hardwired terminal lines is not recommended.

-U, --detect-case

Turn on support for detecting an uppercase-only terminal. This setting will detect a login name containing only capitals as indicating an uppercase-only terminal and turn on some upper-to-lower case conversions. Note that this has no support for any Unicode characters.

-w, --wait-cr

Wait for the user or the modem to send a carriage-return or a linefeed character before sending the /etc/issue file (or others) and the login prompt. This is useful with the --init-string option.

--nohints

Do not print hints about Num, Caps and Scroll Locks.

--nohostname

By default the hostname will be printed. With this option enabled, no hostname at all will be shown. This setting is also possible to able by LOGIN_PLAIN_PROMPT option in the /etc/login.defs configuration file (see below for more details).

--long-hostname

By default the hostname is only printed until the first dot. With this option enabled, the fully qualified hostname by gethostname(3P) or (if not found) by getaddrinfo(3) is shown.

--erase-chars string

This option specifies additional characters that should be interpreted as a backspace ("ignore the previous character") when the user types the login name. The default additional 'erase' has been '#', but since util-linux 2.23 no additional erase characters are enabled by default.

--kill-chars string

This option specifies additional characters that should be interpreted as a kill ("ignore all previous characters") when the user types the login name. The default additional 'kill' has been '@', but since util-linux 2.23 no additional kill characters are enabled by default.

--chdir directory

Change directory before the login.

--delay number

Sleep seconds before open tty.

--nice number

Run login with this priority.

--reload

Ask all running agetty instances to reload and update their displayed prompts, if the user has not yet commenced logging in. After doing so the command will exit. This feature might be unsupported on systems without Linux inotify(7).

-h, --help

Display help text and exit.

-V, --version

Print version and exit.

## CONFIG FILE ITEMS
agetty reads the /etc/login.defs configuration file (see login.defs(5)). Note that the configuration file could be distributed with another package (usually shadow-utils). The following configuration items are relevant for agetty:

LOGIN_PLAIN_PROMPT (boolean)

Tell agetty that printing the hostname should be suppressed in the login: prompt. This is an alternative to the --nohostname command line option. The default value is no.

## EXAMPLE
This section shows examples for the process field of an entry in the /etc/inittab file. You’ll have to prepend appropriate values for the other fields. See inittab(5) for more details.

For a hardwired line or a console tty:

/sbin/agetty 9600 ttyS1

For a directly connected terminal without proper carrier-detect wiring (try this if your terminal just sleeps instead of giving you a password: prompt):

/sbin/agetty --local-line 9600 ttyS1 vt100

For an old-style dial-in line with a 9600/2400/1200 baud modem:

/sbin/agetty --extract-baud --timeout 60 ttyS1 9600,2400,1200

For a Hayes modem with a fixed 115200 bps interface to the machine (the example init string turns off modem echo and result codes, makes modem/computer DCD track modem/modem DCD, makes a DTR drop cause a disconnection, and turns on auto-answer after 1 ring):

/sbin/agetty --wait-cr --init-string 'ATE0Q1&D2&C1S0=1\015' 115200 ttyS1

## SECURITY NOTICE
If you use the --login-program and --login-options options, be aware that a malicious user may try to enter lognames with embedded options, which then get passed to the used login program. agetty does check for a leading "-" and makes sure the logname gets passed as one parameter (so embedded spaces will not create yet another parameter), but depending on how the login binary parses the command line that might not be sufficient. Check that the used login program cannot be abused this way.

Some programs use "--" to indicate that the rest of the command line should not be interpreted as options. Use this feature if available by passing "--" before the username gets passed by \u.

## ISSUE FILES
The default issue file is /etc/issue. If the file exists, then agetty also checks for /etc/issue.d directory. The directory is optional extension to the default issue file and content of the directory is printed after /etc/issue content. If the /etc/issue does not exist, then the directory is ignored. All files with .issue extension from the directory are printed in version-sort order. The directory can be used to maintain 3rd-party messages independently on the primary system /etc/issue file.

Since version 2.35 additional locations for issue file and directory are supported. If the default /etc/issue does not exist, then agetty checks for /run/issue and /run/issue.d, thereafter for /usr/lib/issue and /usr/lib/issue.d. The directory /etc is expected for host specific configuration, /run is expected for generated stuff and /usr/lib for static distribution maintained configuration.

The default path maybe overridden by --issue-file option. In this case specified path has to be file or directory and all the default issue file and directory locations are ignored.

The issue file feature can be completely disabled by --noissue option.

It is possible to review the current issue file by agetty --show-issue on the current terminal.

The issue files may contain certain escape codes to display the system name, date, time et cetera. All escape codes consist of a backslash (\) immediately followed by one of the characters listed below.

4 or 4{interface}

Insert the IPv4 address of the specified network interface (for example: \4{eth0}). If the interface argument is not specified, then select the first fully configured (UP, non-LOCALBACK, RUNNING) interface. If no configured interface is found, fall back to the IP address of the machine’s hostname.

6 or 6{interface}

The same as \4 but for IPv6.

b

Insert the baudrate of the current line.

d

Insert the current date.

e or e{name}

Translate the human-readable name to an escape sequence and insert it (for example: \e{red}Alert text.\e{reset}). If the name argument is not specified, then insert \033. The currently supported names are: black, blink, blue, bold, brown, cyan, darkgray, gray, green, halfbright, lightblue, lightcyan, lightgray, lightgreen, lightmagenta, lightred, magenta, red, reset, reverse, yellow and white. All unknown names are silently ignored.

s

Insert the system name (the name of the operating system). Same as 'uname -s'. See also the \S escape code.

S or S{VARIABLE}

Insert the VARIABLE data from /etc/os-release. If this file does not exist then fall back to /usr/lib/os-release. If the VARIABLE argument is not specified, then use PRETTY_NAME from the file or the system name (see \s). This escape code can be used to keep /etc/issue distribution and release independent. Note that \S{ANSI_COLOR} is converted to the real terminal escape sequence.

l

Insert the name of the current tty line.

m

Insert the architecture identifier of the machine. Same as uname -m.

n

Insert the nodename of the machine, also known as the hostname. Same as uname -n.

o

Insert the NIS domainname of the machine. Same as hostname -d.

O

Insert the DNS domainname of the machine.

r

Insert the release number of the OS. Same as uname -r.

t

Insert the current time.

u

Insert the number of current users logged in.

U

Insert the string "1 user" or "<n> users" where <n> is the number of current users logged in.

v

Insert the version of the OS, that is, the build-date and such.

An example. On my system, the following /etc/issue file:

```
This is \n.\o (\s \m \r) \t
```

displays as:

```
This is thingol.orcan.dk (Linux i386 1.1.9) 18:29:30
```

## FILES
/var/run/utmp

the system status file.

/etc/issue

printed before the login prompt.

/etc/os-release /usr/lib/os-release

operating system identification data.

/dev/console

problem reports (if syslog(3) is not used).

/etc/inittab

init(8) configuration file for SysV-style init daemon.

## BUGS
The baud-rate detection feature (the --extract-baud option) requires that agetty be scheduled soon enough after completion of a dial-in call (within 30 ms with modems that talk at 2400 baud). For robustness, always use the --extract-baud option in combination with a multiple baud rate command-line argument, so that BREAK processing is enabled.

The text in the /etc/issue file (or other) and the login prompt are always output with 7-bit characters and space parity.

The baud-rate detection feature (the --extract-baud option) requires that the modem emits its status message after raising the DCD line.

## DIAGNOSTICS
Depending on how the program was configured, all diagnostics are written to the console device or reported via the syslog(3) facility. Error messages are produced if the port argument does not specify a terminal device; if there is no utmp entry for the current process (System V only); and so on.

## AUTHORS
Werner Fink <werner@suse.de>, Karel Zak <kzak@redhat.com>

The original agetty for serial terminals was written by W.Z. Venema <wietse@wzv.win.tue.nl> and ported to Linux by Peter Orbaek <poe@daimi.aau.dk>.

## REPORTING BUGS
For bug reports, use the issue tracker at <https://github.com/util-linux/util-linux/issues>.

## AVAILABILITY
The agetty command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.


airbase-ng

package: aircrack-ng

title: airbase-ng(8)

text:
# airbase-ng(8)

## NAME
airbase-ng - multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself

## SYNOPSIS
airbase-ng [options] <interface name>

## DESCRIPTION
airbase-ng is multi-purpose tool aimed at attacking clients as opposed to the Access Point (AP) itself. Since it is so versatile and flexible, summarizing it is a challenge. Here are some of the feature highlights:

- Implements the Caffe Latte WEP client attack

- Implements the Hirte WEP client attack

- Ability to cause the WPA/WPA2 handshake to be captured

- Ability to act as an ad-hoc Access Point

- Ability to act as a full Access Point

- Ability to filter by SSID or client MAC addresses

- Ability to manipulate and resend packets

- Ability to encrypt sent packets and decrypt received packets

The main idea is of the implementation is that it should encourage clients to associate with the fake AP, not prevent them from accessing the real AP.

A tap interface (atX) is created when airbase-ng is run. This can be used to receive decrypted packets or to send encrypted packets.

As real clients will most probably send probe requests for common/configured networks, these frames are important for binding a client to our softAP. In this case, the AP will respond to any probe request with a proper probe response, which tells the client to authenticate to the airbase-ng BSSID. That being said, this mode could possibly disrupt the correct functionality of many APs on the same channel.

## OPTIONS
-H, --help

Shows the help screen.

-a <bssid>

If the BSSID is not explicitly specified by using "-a <BSSID>", then the current MAC of the specified interface is used.

-i <iface>

Also capture and process from this interface in addition to the replay interface.

-w <WEP key>

If WEP should be used as encryption, then the parameter "-w <WEP key>" sets the en-/decryption key. This is sufficient to let airbase-ng set all the appropriate flags by itself. If the softAP operates with WEP encryption, the client can choose to use open system authentication or shared key authentication. Both authentication methods are supported by airbase-ng. But to get a keystream, the user can try to force the client to use shared key authentication. "-s" forces a shared key auth and "-S <len>" sets the challenge length.

-h <MAC>

This is the source MAC for the man-in-the-middle attack. The "-M" must also be specified.

-f <disallow>

If this option is not specified, it defaults to "-f allow". This means the various client MAC filters (-d and -D) define which clients to accept. By using the "-f disallow" option, this reverses selection and causes airbase-ng to ignore the clients specified by the filters.

-W <0|1>

This sets the beacon WEP flag. Remember that clients will normally only connect to APs which are the same as themselves. Meaning WEP to WEP, open to open. The "auto" option is to allow airbase-ng to automatically set the flag based on context of the other options specified. For example, if you set a WEP key with -w, then the beacon flag would be set to WEP.

One other use of "auto" is to deal with clients which can automatically adjust their connection type. However, these are few and far between.

In practice, it is best to set the value to the type of clients you are dealing with.

-q

This suppresses printing any statistics or status information.

-v

This prints additional messages and details to assist in debugging.

-M

This option is not implemented yet. It is a man-in-the-middle attack between specified clients and BSSIDs.

-A, --ad-hoc

This causes airbase-ng to act as an ad-hoc client instead of a normal Access Point. In ad-hoc mode airbase-ng also sends beacons, but doesn't need any authentication/association. It can be activated by using "-A". The soft AP will adjust all flags needed to simulate a station in ad-hoc mode automatically and generate a random MAC, which is used as CELL MAC instead of the BSSID. This can be overwritten by the "-a <BSSID>" tag. The interface MAC will then be used as source mac, which can be changed with "-h <sourceMAC>".

-Y <in|out|both>

The parameter "-Y" enables the "external processing" Mode. This creates a second interface "atX", which is used to replay/modify/drop or inject packets at will. This interface must also be brought up with ifconfig and an external tool is needed to create a loop on that interface. The packet structure is rather simple: the ethernet header (14 bytes) is ignored and right after that follows the complete ieee80211 frame the same way it is going to be processed by airbase-ng (for incoming packets) or before the packets will be sent out of the wireless card (outgoing packets). This mode intercepts all data packets and loops them through an external application, which decides what happens with them. The MAC and IP of the second tap interface doesn't matter, as real ethernet frames on this interface are dropped anyway.

There are 3 arguments for "-Y": "in", "out" and "both", which specify the direction of frames to loop through the external application. Obviously "in" redirects only incoming (through the wireless NIC) frames, while outgoing frames aren't touched. "out" does the opposite, it only loops outgoing packets and "both" sends all both directions through the second tap interface.

There is a small and simple example application to replay all frames on the second interface. The tool is called "replay.py" and is located in "./test". It's written in python, but the language doesn't matter. It uses pcapy to read the frames and scapy to possibly alter/show and reinject the frames. The tool as it is, simply replays all frames and prints a short summary of the received frames. The variable "packet" contains the complete ieee80211 packet, which can easily be dissected and modified using scapy.

This can be compared to ettercap filters, but is more powerful, as a real programming language can be used to build complex logic for filtering and packet customization. The downside on using python is, that it adds a delay of around 100ms and the cpu utilizations is rather large on a high speed network, but its perfect for a demonstration with only a few lines of code.

-c <channel>

This is used to specify the channel on which to run the Access Point.

-X, --hidden

This causes the Access Point to hide the SSID and to not broadcast the value.

-s

When specfiied, this forces shared key authentication for all clients. The soft AP will send an "authentication method unsupported" rejection to any open system authentication request if "-s" is specified.

-S

It sets the shared key challenge length, which can be anything from 16 to 1480. The default is 128 bytes. It is the number of bytes used in the random challenge. Since one tag can contain a maximum size of 255 bytes, any value above 255 creates several challenge tags until all specified bytes are written. Many clients ignore values different than 128 bytes so this option may not always work.

-L, --caffe-latte

Airbase-ng also contains the new caffe-latte attack, which is also implemented in aireplay-ng as attack "-6". It can be used with "-L" or "caffe-latte". This attack specifically works against clients, as it waits for a broadcast arp request, which happens to be a gratuitous arp. See this for an explanation of what a gratuitous arp is. It then flips a few bits in the sender MAC and IP, corrects the ICV (crc32) value and sends it back to the client, where it came from. The point why this attack works in practice is, that at least windows sends gratuitous arps after a connection on layer 2 is established and a static ip is set, or dhcp fails and windows assigned an IP out of 169.254.X.X. "-x <pps>" sets the number of packets per second to send when performing the caffe-latte attack. At the moment, this attack doesn't stop, it continuously sends arp requests. Airodump-ng is needed to capture the replies.

-N, --cfrag

This attack listens for an ARP request or IP packet from the client. Once one is received, a small amount of PRGA is extracted and then used to create an ARP request packet targeted to the client. This ARP request is actually made of up of multiple packet fragments such that when received, the client will respond. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.

-x <nbpps>

This sets the number of packets per second that packets will be sent (default: 100).

-y

When using this option, the fake AP will not respond to broadcast probes. A broadcast probe is where the specific AP is not identified uniquely. Typically, most APs will respond with probe responses to a broadcast probe. This flag will prevent this happening. It will only respond when the specific AP is uniquely requested.

-0

This enables all WPA/WPA2/WEP Tags to be enabled in the beacons sent. It cannot be specified when also using -z or -Z.

-z <type>

This specifies the WPA beacon tags. The valid values are: 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104.

-Z <type>

same as -z, but for WPA2

-V <type>

This specifies the valid EAPOL types. The valid values are: 1=MD5 2=SHA1 3=auto

-F <prefix>

This option causes airbase-ng to write all sent and received packets to a pcap file on disk. This is the file prefix (like airodump-ng -w).

-P

This causes the fake access point to respond to all probes regardless of the ESSIDs specified.

-I <interval>

This sets the time in milliseconds between each beacon.

-C <seconds>

The wildcard ESSIDs will also be beaconed this number of seconds. A good typical value to use is "-C 60" (require -P).

-n <hex>

ANonce (nonce from the AP) to use instead of a randomized one. It must be 64 hexadecimal characters.

Filter options:

--bssid <MAC>, -b <MAC>

BSSID to filter/use.

--bssids <file>, -B <file>

Read a list of BSSIDs out of that file.

--client <MAC>, -d <MAC>

MAC of client to accept.

--clients <file>, -D <file>

Read a list of client's MACs out of that file.

--essid <ESSID>, -e <ESSID>

Specify a single ESSID. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names

--essids <file>, -E <file>

Read a list of ESSIDs out of that file. It will use the same BSSID for all AP which can generate some interesting output in Airodump-ng like: http://www.chimplabs.com/blog/2015/09/24/unintentional-fun-with-aircrack-ng-at-derbycon-5-0/

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


aireplay-ng

title: aireplay-ng(8)

text:
# aireplay-ng(8)

## NAME
aireplay-ng - inject packets into a wireless network to generate traffic

## SYNOPSIS
aireplay-ng [options] <replay interface>

## DESCRIPTION
aireplay-ng is used to inject/replay frames. The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks which can cause deauthentications for the purpose of capturing WPA handshake data, fake authentications, Interactive packet replay, hand-crafted ARP request injection and ARP-request reinjection. With the packetforge-ng tool it's possible to create arbitrary frames.

aireplay-ng supports single-NIC injection/monitor.

This feature needs driver patching.

## OPTIONS
-H, --help

Shows the help screen.

Filter options:

-b <bssid>

MAC address of access point.

-d <dmac>

MAC address of destination.

-s <smac>

MAC address of source.

-m <len>

Minimum packet length.

-n <len>

Maximum packet length.

-u <type>

Frame control, type field.

-v <subt>

Frame control, subtype field.

-t <tods>

Frame control, "To" DS bit (0 or 1).

-f <fromds>

Frame control, "From" DS bit (0 or 1).

-w <iswep>

Frame control, WEP bit (0 or 1).

-D

Disable AP Detection.

Replay options:

-x <nbpps>

Number of packets per second.

-p <fctrl>

Set frame control word (hex).

-a <bssid>

Set Access Point MAC address.

-c <dmac>

Set destination MAC address.

-h <smac>

Set source MAC address.

-g <nb_packets>

Change ring buffer size (default: 8 packets). The minimum is 1.

-F

Choose first matching packet.

-e <essid>

Fake Authentication attack: Set target SSID (see below). For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names

-o <npackets>

Fake Authentication attack: Set the number of packets for every authentication and association attempt (Default: 1). 0 means auto

-q <seconds>

Fake Authentication attack: Set the time between keep-alive packets in fake authentication mode.

-Q

Fake Authentication attack: Sends reassociation requests instead of performing a complete authentication and association after each delay period.

-y <prga>

Fake Authentication attack: Specifies the keystream file for fake shared key authentication.

-T n

Fake Authentication attack: Exit if fake authentication fails 'n' time(s).

-j

ARP Replay attack : inject FromDS packets (see below).

-k <IP>

Fragmentation attack: Set destination IP in fragments.

-l <IP>

Fragmentation attack: Set source IP in fragments.

-B

Test option: bitrate test.

Source options:

-i <iface>

Capture packets from this interface.

-r <file>

Extract packets from this pcap file.

Miscellaneous options:

-R

disable /dev/rtc usage.

--ignore-negative-one if the interface's channel can't be determined ignore the mismatch, needed for unpatched cfg80211

--deauth-rc <rc>, -Z <rc> Provide a reason code when doing deauthication (between 0 and 255). By default, 7 is used: Class 3 frame received from unassociated STA. 0 is a reserved value. Reason codes explanations can be found in the IEEE802.11 standard or in https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/

Attack modes:

-0 <count>, --deauth=<count>

This attack sends deauthentication packets to one or more clients which are currently associated with a particular access point. Deauthenticating clients can be done for a number of reasons: Recovering a hidden ESSID. This is an ESSID which is not being broadcast. Another term for this is "cloaked" or Capturing WPA/WPA2 handshakes by forcing clients to reauthenticate or Generate ARP requests (Windows clients sometimes flush their ARP cache when disconnected). Of course, this attack is totally useless if there are no associated wireless client or on fake authentications.

-1 <delay>, --fakeauth=<delay>

The fake authentication attack allows you to perform the two types of WEP authentication (Open System and Shared Key) plus associate with the access point (AP). This is only useful when you need an associated MAC address in various aireplay-ng attacks and there is currently no associated client. It should be noted that the fake authentication attack does NOT generate any ARP packets. Fake authentication cannot be used to authenticate/associate with WPA/WPA2 Access Points.

-2, --interactive

This attack allows you to choose a specific packet for replaying (injecting). The attack can obtain packets to replay from two sources. The first being a live flow of packets from your wireless card. The second being from a pcap file. Reading from a file is an often overlooked feature of aireplay-ng. This allows you read packets from other capture sessions or quite often, various attacks generate pcap files for easy reuse. A common use of reading a file containing a packet your created with packetforge-ng.

-3, --arpreplay

The classic ARP request replay attack is the most effective way to generate new initialization vectors (IVs), and works very reliably. The program listens for an ARP packet then retransmits it back to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs which allow you to determine the WEP key.

-4, --chopchop

This attack, when successful, can decrypt a WEP data packet without knowing the key. It can even work against dynamic WEP. This attack does not recover the WEP key itself, but merely reveals the plaintext. However, some access points are not vulnerable to this attack. Some may seem vulnerable at first but actually drop data packets shorter than 60 bytes. If the access point drops packets shorter than 42 bytes, aireplay-ng tries to guess the rest of the missing data, as far as the headers are predictable. If an IP packet is captured, it additionally checks if the checksum of the header is correct after guessing the missing parts of it. This attack requires at least one WEP data packet.

-5, --fragment

This attack, when successful, can obtain 1500 bytes of PRGA (pseudo random generation algorithm). This attack does not recover the WEP key itself, but merely obtains the PRGA. The PRGA can then be used to generate packets with packetforge-ng which are in turn used for various injection attacks. It requires at least one data packet to be received from the access point in order to initiate the attack.

-6, --caffe-latte

In general, for an attack to work, the attacker has to be in the range of an AP and a connected client (fake or real). Caffe Latte attacks allows one to gather enough packets to crack a WEP key without the need of an AP, it just need a client to be in range.

-7, --cfrag

This attack turns IP or ARP packets from a client into ARP request against the client. This attack works especially well against ad-hoc networks. As well it can be used against softAP clients and normal AP clients.

-8, --migmode

This attack works against Cisco Aironet access points configured in WPA Migration Mode, which enables both WPA and WEP clients to associate to an access point using the same Service Set Identifier (SSID). The program listens for a WEP-encapsulated broadcast ARP packet, bitflips it to make it into an ARP coming from the attacker's MAC address and retransmits it to the access point. This, in turn, causes the access point to repeat the ARP packet with a new IV and also to forward the ARP reply to the attacker with a new IV. The program retransmits the same ARP packet over and over. However, each ARP packet repeated by the access point has a new IV as does the ARP reply forwarded to the attacker by the access point. It is all these new IVs which allow you to determine the WEP key.

-9, --test

Tests injection and quality.

## FRAGMENTATION VERSUS CHOPCHOP
Fragmentation:

Pros

- Can obtain the full packet length of 1500 bytes XOR. This means you can subsequently pretty well create any size of packet.

- May work where chopchop does not

- Is extremely fast. It yields the XOR stream extremely quickly when successful.

Cons

- Setup to execute the attack is more subject to the device drivers. For example, Atheros does not generate the correct packets unless the wireless card is set to the mac address you are spoofing.

- You need to be physically closer to the access point since if any packets are lost then the attack fails.

Chopchop

Pro

- May work where frag does not work.

Cons

- Cannot be used against every access point.

- The maximum XOR bits is limited to the length of the packet you chopchop against.

- Much slower then the fragmentation attack.

## AUTHOR
This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airmon-ng

title: airmon-ng(8)

text:
# airmon-ng(8)

## NAME
airmon-ng - POSIX sh script designed to turn wireless cards into monitor mode.

## SYNOPSIS
airmon-ng <start|stop> <interface> [channel] airmon-ng <check> [kill]

## DESCRIPTION
airmon-ng This script can be used to enable monitor mode on wireless interfaces. It may also be used to go back from monitor mode to managed mode. Entering the airmon-ng command without parameters will show the interfaces status. It can also list/kill programs that can interfere with the wireless card operation.

## OPTIONAL PARAMETERS
start <interface> [channel]

Enable monitor mode on an interface (and specify a channel). Note: Madwifi-ng is a special case, 'start' has to be used on wifi interfaces and 'stop' on ath interfaces.

start <interface> [frequency]

Enable monitor mode on an interface (and specify a frequency in MHz). Note: Madwifi-ng is a special case, 'start' has to be used on wifi interfaces and 'stop' on ath interfaces.

stop <interface>

Disable monitor mode and go back to managed mode (except for madwifi-ng where it kills the ath VAP).

check [kill]

List all possible programs that could interfere with the wireless card. If 'kill' is specified, it will try to kill all of them.

--verbose

This flag must precede start/stop/check and can be combined with other parameters or used alone. This flag will increase the verbosity to provide additional useful information which may not be needed for normal operation.

--debug

This flag must precede start/stop/check and can be combined with other parameters or used alone. This flag will increase the verbosity to debug level to assist in troubleshooting errors in airmon-ng. Use this flag when opening a bug, but only use --verbose when requesting support in irc.

--elite

WARNING: DO NOT USE: This flag must precede start or stop and will prevent airmon-ng from removing interfaces. WARNING: Use of this flag will immediately disqualify receiving any support from the aircrack-ng team, due to the fact that this behavior is known to be broken. WARNING!

## AUTHOR
This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). And modified to fit airmon-ng by David Francos Cuartero <xayon@xayon.net>. Most recently modified by Zero_Chaos to update for the airmon-zc rewrite. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)


airodump-ng

title: airodump-ng(8)

text:
# airodump-ng(8)

## NAME
airodump-ng - a wireless packet capture tool for aircrack-ng

## SYNOPSIS
airodump-ng [options] <interface name>

## DESCRIPTION
airodump-ng is used for packet capturing of raw 802.11 frames for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points. Additionally, airodump-ng writes out a text file containing the details of all access points and clients seen.

## OPTIONS
-H, --help

Shows the help screen.

-i, --ivs

It only saves IVs (only useful for cracking). If this option is specified, you have to give a dump prefix (--write option)

-g, --gpsd

Indicate that airodump-ng should try to use GPSd to get coordinates.

-w <prefix>, --write <prefix>

Is the dump file prefix to use. If this option is not given, it will only show data on the screen. Beside this file a CSV file with the same filename as the capture will be created.

-e, --beacons

It will record all beacons into the cap file. By default it only records one beacon for each network.

-u <secs>, --update <secs>

Delay <secs> seconds delay between display updates (default: 1 second). Useful for slow CPU.

--showack

Prints ACK/CTS/RTS statistics. Helps in debugging and general injection optimization. It is indication if you inject, inject too fast, reach the AP, the frames are valid encrypted frames. Allows one to detect "hidden" stations, which are too far away to capture high bitrate frames, as ACK frames are sent at 1Mbps.

-h

Hides known stations for --showack.

--berlin <secs>

Time before removing the AP/client from the screen when no more frames are received (Default: 120 seconds). See airodump-ng source for the history behind this option ;).

-c <channel>[,<channel>[,...]], --channel <channel>[,<channel>[,...]]

Indicate the channel(s) to listen to. By default airodump-ng hops on all 2.4GHz channels.

-C <freq>[,<freq>[,...]]

Indicates the frequencies to listen to. By default airodump-ng hops on all 2.4GHz channels.

-b <abg>, --band <abg>

Indicate the band on which airodump-ng should hop. It can be a combination of 'a', 'b' and 'g' letters ('b' and 'g' uses 2.4GHz and 'a' uses 5GHz). Incompatible with --channel option.

-s <method>, --cswitch <method>

Defines the way airodump-ng sets the channels when using more than one card. Valid values: 0 (FIFO, default value), 1 (Round Robin) or 2 (Hop on last).

-2, --ht20

Set the channel to be in HT20 (802.11n).

-3, --ht40+

Set the channel to be in HT40+ (802.11n). It requires the frequency 20MHz above to be available (4 channels above) and thus some channels are not usable in HT40+. Only channels up to 7 are available in HT40+ in the US (and 9 in most of Europe).

-5, --ht40-

Set the channel to be in HT40- (802.11n). It requires the frequency 20MHz below to be available (4 channels be)low and thus some channels are not usable in HT40-. In 2.4GHz, HT40- channels start at channel 5.

-r <file>

Reads packet from a file.

-T, --real-time

While reading frames from a file specified with '-r <file>', simulate the arrival rate of them, as if they were "live".

-x <msecs>

Active Scanning Simulation (send probe requests and parse the probe responses).

-M, --manufacturer

Display a manufacturer column with the information obtained from the IEEE OUI list. See airodump-ng-oui-update(8)

-U, --uptime

Display APs uptime obtained from its beacon timestamp.

-W, --wps

Display a WPS column with WPS version, config method(s), AP Setup Locked obtained from APs beacon or probe response (if any).

--output-format <formats>

Define the formats to use (separated by a comma). Possible values are: pcap, ivs, csv, gps, kismet, netxml. The default values are: pcap, csv, kismet, kismet-newcore. 'pcap' is for recording a capture in pcap format, 'ivs' is for ivs format (it is a shortcut for --ivs). 'csv' will create an airodump-ng CSV file, 'kismet' will create a kismet csv file and 'kismet-newcore' will create the kismet netxml file. 'gps' is a shortcut for --gps.

Theses values can be combined with the exception of ivs and pcap.

-I <seconds>, --write-interval <seconds>

Output file(s) write interval for CSV, Kismet CSV and Kismet NetXML in seconds (minimum: 1 second). By default: 5 seconds. Note that an interval too small might slow down airodump-ng.

-K <enable>, --background <enable>

Override automatic background detection. Use "0" to force foreground settings and "1" to force background settings. It will not make airodump-ng run as a daemon, it will skip background autodetection and force enable/disable of interactive mode and display updates.

--ignore-negative-one

Removes the message that says 'fixed channel <interface>: -1'.

Filter options:

-t <OPN|WEP|WPA|WPA1|WPA2|WPA3|OWE>, --encrypt <OPN|WEP|WPA|WPA1|WPA2|WPA3|OWE>

It will only show networks matching the given encryption. Note that WPA is a shortcut for WPA1, WPA2 and WPA3. May be specified more than once: '-t OPN -t WPA2'

-d <bssid>, --bssid <bssid>

It will only show networks, matching the given bssid.

-m <mask>, --netmask <mask>

It will only show networks, matching the given bssid ^ netmask combination. Need --bssid (or -d) to be specified.

-a

It will only show associated clients.

-n <int>, --min-packets <int>

The minimum number of packets received by an AP before displaying it.

-N, --essid

Filter APs by ESSID. Can be used several times to match a set of ESSID.

-R, --essid-regex

Filter APs by ESSID using a regular expression.

## INTERACTION
airodump-ng can receive and interpret key strokes while running. The following list describes the currently assigned keys and supposed actions:

a

Select active areas by cycling through these display options: AP+STA; AP+STA+ACK; AP only; STA only

d

Reset sorting to defaults (Power)

i

Invert sorting algorithm

m

Mark the selected AP or cycle through different colors if the selected AP is already marked

o

Enable colored display of APs and their stations.

p

Disable colored display.

q

Quit program.

r

(De-)Activate realtime sorting - applies sorting algorithm every time the display will be redrawn

s

Change column to sort by, which currently includes: First seen; BSSID; PWR level; Beacons; Data packets; Packet rate; Channel; Max. data rate; Encryption; Strongest Ciphersuite; Strongest Authentication; ESSID

SPACE

Pause display redrawing/ Resume redrawing

TAB

Enable/Disable scrolling through AP list

UP

Select the AP prior to the currently marked AP in the displayed list if available

DOWN

Select the AP after the currently marked AP if available

If an AP is selected or marked, all the connected stations will also be selected or marked with the same color as the corresponding Access Point.

## EXAMPLES
airodump-ng -c 9 wlan0mon

Here is an example screenshot:

-----------------------------------------------------------------------

CH 9 ][ Elapsed: 1 min ][ 2007-04-26 17:41 ][ BAT: 2 hours 10 mins ][ WPA handshake: 00:14:6C:7E:40:80

BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:09:5B:1C:AA:1D 11 16 10 0 0 11 54. OPN <length: 7>

00:14:6C:7A:41:81 34 100 57 14 1 9 11 WEP WEP bigbear

00:14:6C:7E:40:80 32 100 752 73 2 9 54 WPA TKIP PSK teddy

BSSID STATION PWR Rate Lost Frames Notes Probes

00:14:6C:7A:41:81 00:0F:B5:32:31:31 51 11-11 2 14 bigbear

(not associated) 00:14:A4:3F:8D:13 19 11-11 0 4 mossy

00:14:6C:7A:41:81 00:0C:41:52:D1:D1 -1 11-2 0 5 bigbear

00:14:6C:7E:40:80 00:0F:B5:FD:FB:C2 35 36-24 0 99 teddy

-----------------------------------------------------------------------

BSSID

MAC address of the access point. In the Client section, a BSSID of "(not associated)" means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.

PWR

Signal level reported by the Wi-Fi adapter. Its signification depends on the driver, but as you get closer to the AP or the station, the signal gets higher. It usually is the RSSI (https://en.wikipedia.org/wiki/Received_signal_strength_indication). If the BSSID PWR is -1, then the driver doesn't support signal level reporting. If PWR is -1 for some access points, it means the access point is out of range, however airodump-ng got at least a frame sent to it. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your Wi-Fi adapter. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then it is likely that the driver doesn't support signal level reporting. A strong signal is around -40. An average one is around -55, and a weak one starts around -70. Wi-Fi adapters lower limit (aka receive sensitivity) is often around -80/-90.

RXQ

Only shown when on a fixed channel. Receive Quality as measured by the percentage of frames (management and data frames) successfully received over the last 10 seconds. It's measured over all management and data frames. That's the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can't hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP.

Beacons

Number of beacons sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.

\#Data

Number of captured data packets (if WEP, unique IV count), including data broadcast packets.

\#/s

Number of data packets per second measure over the last 10 seconds.

CH

Channel number (taken from beacon frames). Note: sometimes frames from other channels are captured even if airodump-ng is not hopping, because of radio interference.

MB

Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g. The dot (after 54 above) indicates short preamble is supported. 'e' indicates that the network has QoS (802.11e) enabled.

ENC

Encryption algorithm in use. OPN = no encryption,"WEP?" = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA or WPA2 if TKIP or CCMP or MGT is present.

CIPHER

The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater than 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.

AUTH

The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).

WPS

This is only displayed when --wps (or -W) is specified. If the AP supports WPS, the first field of the column indicates version supported. The second field indicates WPS config methods (can be more than one method, separated by comma): USB = USB method, ETHER = Ethernet, LAB = Label, DISP = Display, EXTNFC = External NFC, INTNFC = Internal NFC, NFCINTF = NFC Interface, PBC = Push Button, KPAD = Keypad. Locked is displayed when AP setup is locked.

ESSID

The so-called "SSID", which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests.

STATION

MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of "(not associated)".

Rate

This is only displayed when using a single channel. The first number is the last data rate from the AP (BSSID) to the Client (STATION). The second number is the last data rate from Client (STATION) to the AP (BSSID).

Lost

It means lost frames coming from the client. To determine the number of frames lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many frames you have lost.

Notes

Additional information about the client, such as captured EAPOL or PMKID.

Frames

The number of data packets sent by the client.

Probes

The ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected.

The first part is the detected access points. The second part is a list of detected wireless clients, stations. By relying on the signal power, one can even physically pinpoint the location of a given station.

## AUTHOR
This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airodump-ng-oui-update

title: airodump-ng-oui-update(8)

text:
# airodump-ng-oui-update(8)

## NAME
airodump-ng-oui-updater - IEEE oui list updater for airodump-ng

## SYNOPSIS
airodump-ng-oui-updater

## DESCRIPTION
airodump-ng-oui-updater downloads and parses IEEE OUI list.

## AUTHOR
This manual page was written by David Francos Cuartero. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airserv-ng

title: airserv-ng(8)

text:
# airserv-ng(8)

## NAME
airserv-ng - a wireless card server

## SYNOPSIS
airserv-ng <options>

## DESCRIPTION
airserv-ng is a wireless card server which allows multiple wireless application programs to independently use a wireless card via a client-server TCP network connection. All operating system and wireless card driver specific code is incorporated into the server. This eliminates the need for each wireless application to contain the complex wireless card and driver logic. It is also supports multiple operating systems.

## OPTIONS
-h

Shows the help screen.

-p <port>

TCP port to listen on (by default: 666).

-d <iface>

Wifi interface to use.

-c <chan>

Lock interface to this channel.

-v <level>

Debug level. There are 3 debug levels. Debug level of 1 shows client connection/disconnection (default). Debug level of 2 shows channel change requests and invalid client command requests in addition to the debug level 1 messages. Debug level of 3 displays a message each time a packet (and its length) is sent to the client. It also include messages from level 2 (and 1).

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airtun-ng

title: airtun-ng(8)

text:
# airtun-ng(8)

## NAME
airtun-ng - a virtual tunnel interface creator for aircrack-ng

## SYNOPSIS
airtun-ng [options] <interface name>

## DESCRIPTION
airtun-ng creates a virtual tunnel interface (atX) for sending arbitrary IP packets by using raw ieee802.11 packet injection.

## OPTIONS
-H, --help

Shows the help screen.

-x <pps>

Sets maximum number of packets per second.

-a <BSSID>

Specifies the BSSID for the iee802.11 header. In WDS Mode this sets the Receiver.

-h <SMAC>

Specifies the source MAC for the iee802.11 header.

-i <iface>

Sets the capture interface.

-r <file>

Specifies a file to read 802.11 frames.

-y <PRGA-file>

Is the name of the file, which provides the keystream for WEP encoding. (No receiving, just transmitting of IP packets.)

-w <WEP-key>

This is the WEP key to en-/decrypt all traffic going through the tunnel.

-e <ESSID>

Sets the target network SSID (use with -p).

-p <passphrase>

Use this WPA passphrase to decrypt packets (use with -a and -e).

-t <tods>

Defines the ToDS and FromDS bit in the ieee802.11 header. For tods=1, the ToDS bit is set to 1 and FromDS to 0, while tods=0 sets them the other way around. If set to 2, it will be tunneled in a WDS/bridge.

-m <netmask>, --netmask <netmask>

Filters networks based on bssid ^ netmask combination. Needs -d, used in replay mode.

-d <BSSID>, --bssid <BSSID>

Filters networks based on the <BSSID>. Used in replay mode.

-f, --repeat

Enables replay mode. All read frames, filtered by bssid and netmask (if specified), will be replayed.

-s <transmitter>

Set Transmitter MAC address for WDS Mode.

-b

Bidirectional mode. This enables communication in Transmitter's AND Receiver's networks. Works only if you can see both stations.

## EXAMPLES
airtun-ng -a 00:14:22:56:F3:4E -t 0 -y keystream.xor wlan0

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


airventriloquist-ng

title: airventriloquist-ng(8)

text:
# airventriloquist-ng(8)

## NAME
airventriloquist-ng - encrypted WiFi packet injection

## SYNOPSIS
airventriloquist-ng [options]

## DESCRIPTION
airventriloquist-ng injects on encrypted WiFi packet and circumvents wireless intrusion prevention systems.

## OPTIONS
--help

Shows the help screen.

-i <replay interface>

Interface to capture and inject. Mandatory option.

-d, --deauth

Sends active deauthentications frames to encrypted stations.

-e <value>, --essid <value>

ESSID of target network. For SSID containing special characters, see https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names

-p <value>, --passphrase <value>

WPA Passphrase of the target network. Passphrase is between 8 and 63 characters long.

-c, --icmp

Respond to all ICMP frames (Debug).

-n, --dns

IP to resolve all DNS queries to.

-s <URL>, --hijack <URL>

URL to look for in HTTP requests when hijacking connections. The URL can have wildcards characters. Example: *jquery*.js*

-r <URL>, --redirect <URL>

URL to redirect hijacked connections to.

-v, --verbose

Verbose output.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airtun-ng(8)


besside-ng

title: besside-ng(8)

text:
# besside-ng(8)

## NAME
besside-ng - crack a WEP or WPA key without user intervention and collaborate with WPA cracking statistics

## SYNOPSIS
besside-ng [options] <interface>

## DESCRIPTION
besside-ng is a tool which will crack all the WEP networks in range and log all the WPA handshakes. WPA handshakes can be uploaded to the online cracking service at wpa.darkircop.org. Wpa.darkircop.com also provides useful statistics based on user-submitted capture files about the feasibility of WPA cracking.

-b <target mac>

Specifies the target's BSSID

-s <WPA server>

Where to upload capture file for cracking. A good choice is wpa.darkircop.org

-c <chan>

Channel lock

-p <pps>

Packages per second to send (flood rate).

-W

Crack only WPA networks

-v

Verbose mode. Use -vv for more verbose, -vv for even more and so on.

-h

Help screen

## AUTHOR
This manual page was written by David Francos Cuartero. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

easside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


easside-ng

title: easside-ng(8)

text:
# easside-ng(8)

## NAME
easside-ng - an auto-magic tool which allows you to communicate via an WEP-encrypted AP without knowing the key

## SYNOPSIS
easside-ng <options>

## DESCRIPTION
easside-ng is an auto-magic tool which allows you to communicate via an WEP-encrypted access point (AP) without knowing the WEP key. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme and then setup a TAP interface so that you can communicate with the AP without requiring the WEP key. All this is done without your intervention.

## OPTIONS
-h

Shows the help screen.

-v <victim mac>

Victim BSSID (Optional).

-m <src mac>

Source MAC address to be used (Optional).

-i <ip>

Source IP address to be used on the wireless LAN. Defaults to the decoded network plus '.123' (Optional).

-r <router ip>

IP address of the AP router. This could be the WAN IP of the AP or an actual router IP depending on the topology. Defaults to the decoded network plus '.1' (Optional).

-s <buddy ip>

IP address of Buddy-ng server (Mandatory)

-f <iface>

Wireless interface to use (Mandatory)

-c <channel>

Lock interface to this channel (Optional).

-n

Determine Internet IP only.

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

tkiptun-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


tkiptun-ng

title: tkiptun-ng(8)

text:
# tkiptun-ng(8)

## NAME
tkiptun-ng - inject a few frames into a WPA TKIP network with QoS

## SYNOPSIS
tkiptun-ng [options] <replay interface>

## DESCRIPTION
tkiptun-ng is a tool created by Martin Beck aka hirte, a member of aircrack-ng team. This tool is able to inject a few frames into a WPA TKIP network with QoS. He worked with Erik Tews (who created PTW attack) for a conference in PacSec 2008: "Gone in 900 Seconds, Some Crypto Issues with WPA".

## OPERATION
-H, --help

Shows the help screen.

Filter options:

-d <dmac>

MAC address of destination.

-s <smac>

MAC address of source.

-m <len>

Minimum packet length.

-n <len>

Maximum packet length.

-t <tods>

Frame control, "To" DS bit.

-f <fromds>

Frame control, "From" DS bit.

-D

Disable AP Detection.

Replay options:

-x <nbpps>

Number of packets per second.

-p <fctrl>

Set frame control word (hex).

-a <bssid>

Set Access Point MAC address.

-c <dmac>

Set destination MAC address.

-h <smac>

Set source MAC address.

-e <essid>

Set target SSID.

-M <sec>

MIC error timeout in seconds. Default: 60 seconds

Debug options:

-K <prga>

Keystream for continuation.

-y <file>

Keystream file for continuation.

-j

Inject FromFS packets.

-P <PMK>

Pairwise Master key (PMK) for verification or vulnerability testing.

-p <PSK>

Preshared key (PSK) to calculate PMK with essid.

Source options:

-i <iface>

Capture packets from this interface.

-r <file>

Extract packets from this pcap file.

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

wesside-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


wesside-ng

title: wesside-ng(8)

text:
# wesside-ng(8)

## NAME
wesside-ng - crack a WEP key of an open network without user intervention

## SYNOPSIS
wesside-ng <options>

## DESCRIPTION
wesside-ng is an auto-magic tool which incorporates a number of techniques to seamlessly obtain a WEP key in minutes. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme, reinject ARP requests and finally determine the WEP key. All this is done without your intervention.

## OPTIONS
-h

Shows the help screen.

-i <iface>

Wireless interface name. (Mandatory)

-n <network ip>

Network IP as in 'who has destination IP (netip) tell source IP (myip)'. Defaults to the source IP on the ARP request which is captured and decrypted. (Optional)

-m <my ip>

'who has destination IP (netip) tell source IP (myip)'. Defaults to the network.123 on the ARP request captured (Optional).

-a <source mac>

Source MAC address (Optional)

-c

Do not crack the key. Simply capture the packets until control-C is hit to stop the program! (Optional)

-p <min PRGA>

Determines the minimum number of bytes of PRGA which is gathered. Defaults to 128 bytes. (Optional).

-v <victim MAC>

Wireless access point MAC address (Optional).

-t <threshold>

For each number of IVs specified, restart the airecrack-ng PTW engine (Optional). It will restart PTW every <threshold> IVs.

-f <channel>

Allows the highest channel for scanning to be defined. Defaults to channel 11 (Optional).

## AUTHOR
This manual page was written by Thomas d'Otreppe. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.

## SEE ALSO
airbase-ng(8)

aireplay-ng(8)

airmon-ng(8)

airodump-ng(8)

airodump-ng-oui-update(8)

airserv-ng(8)

airtun-ng(8)

besside-ng(8)

easside-ng(8)

tkiptun-ng(8)

aircrack-ng(1)

airdecap-ng(1)

airdecloak-ng(1)

airolib-ng(1)

besside-ng-crawler(1)

buddy-ng(1)

ivstools(1)

kstats(1)

makeivs-ng(1)

packetforge-ng(1)

wpaclean(1)

airventriloquist(8)


alterator-cmdline

package: alterator

title: alterator-cmdline(8)

summary: command line interface to alteratord.

text:
# alterator-cmdline(8)

## NAME
alterator-cmdline - command line interface to alteratord.

## SYNOPSIS
alterator-cmdline [-ld] [-k name] command

## DESCRIPTION
This is an utility to create a single request to system configuration backend from command line. Query result will be sent to stdout. Errors, e.g., exceptions from backends, will be sent to stderr.

Command format is:

backend arg1 value arg2 value2 ...

Backend typically returns one or more answers. Each answer is a set of attributes and values.

Output format is:

<empty line>

arg1:value1

arg2:value2

<empty line>

arg1:value3

arg2:value4

...

Each answer starts with an empty line.

alterator-cmdline prints all attributes and their values by default. You can use -k option to print specified attribute's value only. This is useful in shell scripts.

Output format in this case is:

value1

value3

...

Multiple answers are not separated.

There are two possible modes: basic and local.

In basic mode utility will try to connect to already running alteratord.

Local mode is designed for development. alterator-cmdline will try to stop already running alteratord and start it as its own subprocess; in its turn, alteratord's subprocess will work in local mode too and exit when alterator-cmdline exits. Because command line interface exits after receiving an answer from backend, you can only work with stateless backends in this mode.

## EXAMPLE
alterator-cmdline -k name /users action list

alterator-cmdline /users name "test" action write gecos "test user"

## EXIT CODE
On success zero is returned, otherwise non-zero status indicates request failure (backend exception or some internal error).

## OPTIONS
-l, --local

Work in local mode.

-d, --debug

Turn on additional debug in Scheme interpreter. This is useful for debugging alterator-cmdline itself.

-k, --key <name>

Print values for the specified attribute only.

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
alteratord(8)


alteratord

title: alteratord(8)

text:
# alteratord(8)

## NAME
alteratord - a daemon to interact with alterator backends.

## SYNOPSIS
alteratord [ -ld ] [ -t <sec> ]

## DESCRIPTION
alteratord process waits for incoming configuration requests and sends them to appropriate backends. Loaded backends are resident in memory for possible reuse. After 5 hours of inactivity a backend will be unloaded. Please note that unloading will not take place asynchronously but at nearest incoming request only. All backends will automatically receive SIGHUP signal when alteratord exits. You can trap this signal in a backend to perform some cleanup actions.

The process communicates using local domain socket. You should be superuser (root) or member of group _alteratord to have access to this socket.

Attention: Current implementation is NOT reenterable (doesn't support multiple requests at the same time), so you cannot call alteratord (other backends) inside backend code.

alteratord supports different execution schemas.

1. Start every time at system boot. Please note that alteratord service is turned off by default.

2. Start as a subprocess and exit when main process exits. This mode is used in acc, alterator-standalone, and in local mode of all interface frameworks (ahttpd, alterator-cmdline, and alterator-standalone).

3. Start on demand (using special helper) and exit automatically after 1 minute of inactivity. All interfaces will try to execute alteratord in this mode if it's is unavailable.

Please note that some backends can lock system resources, e.g. RPM package database.

## OPTIONS
-l,--local

Local mode. This is a special mode for developers. alteratord will try to use backends and guile modules from local project directory. In this mode ALTERATOR_DEBUG environment variable is exported with value 1. Some libraries use this variable, e.g. alterator-sh-functions for write_debug().

-d,--debug

Turn on additional debug in Scheme interpreter. This is useful for debugging alteratord itself.

-t,--timeout <sec>

Exit automatically after specified number of seconds of inactivity.

## ENVIRONMENT VARIABLES
alteratord and backends can use some environment variables. Multiple values are separated by a colon.

ALTERATOR_DATADIR

Directories with platfrom independent data. Some backends, e.g. help and menu can also use this variable. Default value is /usr/share/alterator.

ALTERATOR_LIBDIR

Directories with scripts and binary programs (not libraries). There are various backends and hooks for communications between backends. Default value is /usr/lib/alterator.

## FILES
/usr/lib/alterator/interfaces/guile

Scheme libraries.

/usr/lib/alterator/backend3

Directory for backends.

/usr/lib/alteratord/control

Helper utility to run alteratord on demand. This program is SUID root and is available to members of _alteratord group only.

/run/alteratord/.socket

Local domain socket to communicate with alteratord.

/var/log/alteratord.log

Backends' stderr gets stored here. This file is recreated at every restart. If alteratord is staying in foreground this file is not used.

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
ahttpd(8), alterator-cmdline(8)


ahttpd

package: alterator-fbi

title: ahttpd(8)

text:
# ahttpd(8)

## NAME
ahttpd - special HTTP server for alterator's web interface.

## SYNOPSIS
ahttpd [ -ld ] [ -c <config file> ]

## DESCRIPTION
ahttpd is a minimalistic HTTP server written in Scheme scripting language to serve alterator's web interface. It was created specifically for alterator and can't be used as a generic web server. This server processes incoming connections only via HTTPS and will automatically answer HTTP requests with redirects to use HTTPS protocol.

Server runs with unpriveledged user and group permissions. Server's user account should be member of _alteratord group to have access to alteratord socket.

## OPTIONS
-l --local

Run in local mode. This mode is designed specifically for alterator module development. Server will stay in foreground and also run alteratord subprocess in local mode too. It means that both alterator and alteratord servers will try to use files (backends, interface descriptions, and scheme modules) from your local project directory.

-d --debug

Enable additional debug in Scheme interpreter. It's useful for debugging ahttpd itself.

-c --config

Use alternate configuration file

## FILES
/etc/ahttpd/ahttpd.conf - main configuration

/etc/ahttpd/acl.conf - ACL configuration

/etc/ahttpd/openssl.cnf - SSL configuration (for OpenSSL, the syntax is the same as for /etc/openssl/openssl.cnf)

/var/log/ahttpd/access.log - server access log

/usr/share/alterator/ui/ - module interfaces

/usr/share/alterator/applications/ - descriptions of modules

/usr/share/alterator/desktop-directories/ - descriptions of module groups

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
ahttpd.conf(5), ahttpd.acl.conf(5), alteratord(8)


acc

package: alterator-standalone

title: acc(8)

text:
# acc(8)

## NAME
acc - graphical user interface to alteratord, system management center.

## SYNOPSIS
acc [-ld]

## DESCRIPTION
acc opens a window with system management center GUI.

The utility will always try to stop currently running alteratord, if any, and (re-)run it as its own subprocess.

In local mode acc will try to use interface definitions from local project directory and start alteratord in local mode too.

## OPTIONS
-l, --local

Work in local mode.

-d, --debug

Turn on additional debug in Scheme interpreter. This is useful for debugging acc itself.

## FILES
/usr/share/alterator/ui/ - module interfaces

/usr/share/alterator/applications/ - descriptions of modules

/usr/share/alterator/desktop-directories/ - descriptions of module groups

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
alteratord(8)


alterator-standalone

title: alterator-standalone(8)

text:
# alterator-standalone(8)

## NAME
alterator-standalone - graphical user interface to alteratord, single-module version

## SYNOPSIS
alterator-standalone [-ld] [module]

## DESCRIPTION
alterator-standalone opens a window containing the interface of a single module.

Single parameter is a name of the module description file without extension, e.g., if module description is in file /usr/share/alterator/applications/foo.desktop you should start alterator-standalone with parameter foo.

If module name is omitted all available module names will be displayed.

Utility will always try to stop running alteratord and run it as its own subprocess.

In local mode it will try to use interface definitions and module description file from local project directory and will start alteratord in local mode too.

## OPTIONS
-l, --local

Work in local mode.

-d, --debug

Turn on additional debug in Scheme interpreter. This is useful for debugging alterator-standalone itself.

## EXAMPLE
/usr/sbin/alterator-standalone datetime

## FILES
/usr/share/alterator/ui/ - interface definitions.

/usr/share/alterator/applications/ - descriptions of modules.

/usr/share/alterator/desktop-directories/ - descriptions of module groups.

## AUTHOR
Stanislav Ievlev <inger@altlinux.org>

## SEE ALSO
alteratord(8)


altsign-agent

package: altsign-agent

title: altsign-agent(8)

text:
# altsign-agent(8)

## NAME
altsign-agent - control daemon for altsign signing sessions

## SYNOPSIS
altsign-agent [OPTIONS]

## DESCRIPTION
altsign-agent is a local control daemon that brokers signing sessions for the altsign service. It listens on a control UNIX domain socket and accepts requests to start a signing session for a specific certificate nickname. Authorized clients receive a session socket path, which they can use to submit signing requests.

Each session is served by a forked child that listens on the session socket and invokes ssh(1) to execute a remote signing command:

ssh SERVER sign {module|PE} CERT

The daemon refuses to run as root. The control socket directory must already exist. The session socket directory must also already exist.

## OPTIONS
-S, --socket=SOCKET

Control socket path (default: /run/altsign-module/control.sock). If not specified, the default is selected by the mode flags (--module by default, --pe for PE). You can also set ALTSIGN_AGENT_SOCKET.

-T, --session-socket=SOCKET

Session socket path (default: /run/altsign-module/session/sockdir/session.sock). If not specified, the default is selected by the mode flags (--module by default, --pe for PE). You can also set ALTSIGN_AGENT_SESSION_SOCKET.

--module

Use module socket paths when selecting defaults. This is the default mode. This option is mutually exclusive with --pe.

--pe

Use PE socket paths when selecting defaults. This option is mutually exclusive with --module.

-g, --admin-group=GROUP

Administrative group allowed to open the control socket. Default: altsign-admin. You can also set ALTSIGN_AGENT_ADMIN_GROUP.

-s, --server=SERVER

SSH server name or alias used for signing. This option is required unless ALTSIGN_AGENT_SERVER is set.

-v, --verbose

Enable verbose logging. You can also set ALTSIGN_AGENT_VERBOSE to any non-empty, non-zero value.

-y, --syslog

Enable syslog logging. You can also set ALTSIGN_AGENT_SYSLOG to any non-empty, non-zero value.

-?, --help

Show the full help text.

--usage

Show a short usage summary.

## ENVIRONMENT
ALTSIGN_AGENT_SOCKET

Default control socket path (overridden by --socket).

ALTSIGN_AGENT_SESSION_SOCKET

Default session socket path (overridden by --session-socket).

ALTSIGN_AGENT_ADMIN_GROUP

Default administrative group (overridden by --admin-group).

ALTSIGN_AGENT_SERVER

Default SSH server (overridden by --server).

ALTSIGN_AGENT_VERBOSE

Enable verbose logging when set to a non-empty, non-zero value.

ALTSIGN_AGENT_SYSLOG

Enable syslog logging when set to a non-empty, non-zero value.

ALTSIGN_AGENT_DRY_RUN

When set, the session daemon skips remote signing and simply copies input to output.

## ACCESS CONTROL
Control socket clients are authorized by peer credentials. Root is always allowed. Non-root clients must belong to the administrative group.

## FILES
/run/altsign-module/control.sock

Module service control socket.

/run/altsign-pe/control.sock

PE service control socket.

/run/altsign-module/session/sockdir

Module service session socket directory.

/run/altsign-pe/session/sockdir

PE service session socket directory.

/run/altsign-module/session/sockdir/session.sock

Module service session socket path.

/run/altsign-pe/session/sockdir/session.sock

PE service session socket path.

/usr/bin/ssh

SSH client used for remote signing.

## EXIT STATUS
0

Exited cleanly.

non-zero

An error occurred during startup or runtime.

## EXAMPLES
Start the agent daemon with an explicit SSH server (module mode by default):

```
altsign-agent --server signer.example.org

```

Start the agent daemon in PE mode (select PE default socket paths):

```
altsign-agent --pe --server signer.example.org

```

## SEE ALSO
altsign-set(1), altsign(1), ssh(1)


awg

package: amneziawg-tools

title: awg(8)

text:
# awg(8)

## NAME
wg - set and retrieve configuration of WireGuard interfaces

## SYNOPSIS
wg [ COMMAND ] [ OPTIONS ]... [ ARGS ]...

## DESCRIPTION
wg is the configuration utility for getting and setting the configuration of WireGuard tunnel interfaces. The interfaces themselves can be added and removed using ip-link(8) and their IP addresses and routing tables can be set using ip-address(8) and ip-route(8). The wg utility provides a series of sub-commands for changing WireGuard-specific aspects of WireGuard interfaces.

If no COMMAND is specified, COMMAND defaults to show. Sub-commands that take an INTERFACE must be passed a WireGuard interface.

## COMMANDS
show { <interface> | all | interfaces } [public-key | private-key | listen-port | fwmark | peers | preshared-keys | endpoints | allowed-ips | latest-handshakes | persistent-keepalive | transfer | dump]

Shows current WireGuard configuration and runtime information of specified <interface>. If no <interface> is specified, <interface> defaults to all. If interfaces is specified, prints a list of all WireGuard interfaces, one per line, and quits. If no options are given after the interface specification, then prints a list of all attributes in a visually pleasing way meant for the terminal. Otherwise, prints specified information grouped by newlines and tabs, meant to be used in scripts. For this script-friendly display, if all is specified, then the first field for all categories of information is the interface name. If dump is specified, then several lines are printed; the first contains in order separated by tab: private-key, public-key, listen-port, fwmark. Subsequent lines are printed for each peer and contain in order separated by tab: public-key, preshared-key, endpoint, allowed-ips, latest-handshake, transfer-rx, transfer-tx, persistent-keepalive.

showconf <interface>

Shows the current configuration of <interface> in the format described by CONFIGURATION FILE FORMAT below.

set <interface> [listen-port <port>] [fwmark <fwmark>] [private-key <file-path>] [peer <base64-public-key> [remove] [preshared-key <file-path>] [endpoint <ip>:<port>] [persistent-keepalive <interval seconds>] [allowed-ips <ip1>/<cidr1>[,<ip2>/<cidr2>]...] ]...

Sets configuration values for the specified <interface>. Multiple peers may be specified, and if the remove argument is given for a peer, that peer is removed, not configured. If listen-port is not specified, or set to 0, the port will be chosen randomly when the interface comes up. Both private-key and preshared-key must be files, because command line arguments are not considered private on most systems but if you are using bash(1), you may safely pass in a string by specifying as private-key or preshared-key the expression: <(echo PRIVATEKEYSTRING). If /dev/null or another empty file is specified as the filename for either private-key or preshared-key, the key is removed from the device. The use of preshared-key is optional, and may be omitted; it adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance. If allowed-ips is specified, but the value is the empty string, all allowed ips are removed from the peer. The use of persistent-keepalive is optional and is by default off; setting it to 0 or "off" disables it. Otherwise it represents, in seconds, between 1 and 65535 inclusive, how often to send an authenticated empty packet to the peer, for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds; however, most users will not need this. The use of fwmark is optional and is by default off; setting it to 0 or "off" disables it. Otherwise it is a 32-bit fwmark for outgoing packets and may be specified in hexadecimal by prepending "0x".

setconf <interface> <configuration-filename>

Sets the current configuration of <interface> to the contents of <configuration-filename>, which must be in the format described by CONFIGURATION FILE FORMAT below.

addconf <interface> <configuration-filename>

Appends the contents of <configuration-filename>, which must be in the format described by CONFIGURATION FILE FORMAT below, to the current configuration of <interface>.

syncconf <interface> <configuration-filename>

Like setconf, but reads back the existing configuration first and only makes changes that are explicitly different between the configuration file and the interface. This is much less efficient than setconf, but has the benefit of not disrupting current peer sessions. The contents of <configuration-filename> must be in the format described by CONFIGURATION FILE FORMAT below.

genkey

Generates a random private key in base64 and prints it to standard output.

genpsk

Generates a random preshared key in base64 and prints it to standard output.

pubkey

Calculates a public key and prints it in base64 to standard output from a corresponding private key (generated with genkey) given in base64 on standard input. A private key and a corresponding public key may be generated at once by calling:

$ umask 077

$ wg genkey | tee private.key | wg pubkey > public.key

help

Shows usage message.

## CONFIGURATION FILE FORMAT
The configuration file format is based on INI. There are two top level sections -- Interface and Peer. Multiple Peer sections may be specified, but only one Interface section may be specified.

The Interface section may contain the following fields:

- PrivateKey — a base64 private key generated by wg genkey. Required.

- ListenPort — a 16-bit port for listening. Optional; if not specified, chosen randomly.

- FwMark — a 32-bit fwmark for outgoing packets. If set to 0 or "off", this option is disabled. May be specified in hexadecimal by prepending "0x". Optional.

The Peer sections may contain the following fields:

- PublicKey — a base64 public key calculated by wg pubkey from a private key, and usually transmitted out of band to the author of the configuration file. Required.

- PresharedKey — a base64 preshared key generated by wg genpsk. Optional, and may be omitted. This option adds an additional layer of symmetric-key cryptography to be mixed into the already existing public-key cryptography, for post-quantum resistance.

- AllowedIPs — a comma-separated list of IP (v4 or v6) addresses with CIDR masks from which incoming traffic for this peer is allowed and to which outgoing traffic for this peer is directed. The catch-all 0.0.0.0/0 may be specified for matching all IPv4 addresses, and ::/0 may be specified for matching all IPv6 addresses. May be specified multiple times.

- Endpoint — an endpoint IP or hostname, followed by a colon, and then a port number. This endpoint will be updated automatically to the most recent source IP address and port of correctly authenticated packets from the peer. Optional.

- PersistentKeepalive — a seconds interval, between 1 and 65535 inclusive, of how often to send an authenticated empty packet to the peer for the purpose of keeping a stateful firewall or NAT mapping valid persistently. For example, if the interface very rarely sends traffic, but it might at anytime receive traffic from a peer, and it is behind NAT, the interface might benefit from having a persistent keepalive interval of 25 seconds. If set to 0 or "off", this option is disabled. By default or when unspecified, this option is off. Most users will not need this. Optional.

## CONFIGURATION FILE FORMAT EXAMPLE
This example may be used as a model for writing configuration files, following an INI-like syntax. Characters after and including a '#' are considered comments and are thus ignored.

[Interface]

PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=

ListenPort = 51820

[Peer]

PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=

Endpoint = 192.95.5.67:1234

AllowedIPs = 10.192.122.3/32, 10.192.124.1/24

[Peer]

PublicKey = TrMvSoP4jYQlY6RIzBgbssQqY3vxI2Pi+y71lOWWXX0=

Endpoint = [2607:5300:60:6b0::c05f:543]:2468

AllowedIPs = 10.192.122.4/32, 192.168.0.0/16

[Peer]

PublicKey = gN65BkIKy1eCE9pP1wdc8ROUtkHLF2PfAqYdyYBz6EA=

Endpoint = test.wireguard.com:18981

AllowedIPs = 10.10.10.230/32

## DEBUGGING INFORMATION
Sometimes it is useful to have information on the current runtime state of a tunnel. When using the Linux kernel module on a kernel that supports dynamic debugging, debugging information can be written into dmesg(1) by running as root:

\# modprobe wireguard && echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control

On OpenBSD and FreeBSD, debugging information can be written into dmesg(1) on a per-interface basis by using ifconfig(1):

\# ifconfig wg0 debug

On userspace implementations, it is customary to set the LOG_LEVEL environment variable to verbose.

## ENVIRONMENT VARIABLES
WG_COLOR_MODE

If set to always, always print ANSI colorized output. If set to never, never print ANSI colorized output. If set to auto, something invalid, or unset, then print ANSI colorized output only when writing to a TTY.

WG_HIDE_KEYS

If set to never, then the pretty-printing show sub-command will show private and preshared keys in the output. If set to always, something invalid, or unset, then private and preshared keys will be printed as "(hidden)".

WG_ENDPOINT_RESOLUTION_RETRIES

If set to an integer or to infinity, DNS resolution for each peer's endpoint will be retried that many times for non-permanent errors, with an increasing delay between retries. If unset, the default is 15 retries.

## SEE ALSO
wg-quick(8), ip(8), ip-link(8), ip-address(8), ip-route(8).

## AUTHOR
wg was written by Jason A. Donenfeld. For updates and more information, a project page is available on the World Wide Web.