etcnet-options

package: etcnet

title: etcnet-options(5)

text:
# etcnet-options(5)

## NAME
/etc/net interface options

## OPTIONS
Common options

TYPE

This option defines interface type. It is required, if interface type cannot be found from interface name and if DISABLED is not set.

DISABLED

Set to "yes" to ignore the interface. Note that setting DISABLED to "yes" in ifaces/default/options and having no "DISABLED=no" in interface-specific options file will effectively disable ALL interfaces.

BOOTPROTO

BOOTPROTO can be any of the following: static, dhcp, dhcp6, ipv4ll. static use ipv4address/ipv6address. It has the same meaning as 'none' in initscripts/net-scripts sense. If you don't want to assign any address to an interface, but still keep it up and running, you can just use 'static' and have no ipv4address file.

dhcp run DHCP client

ipv4ll run IPv4LL client, currently avahi-autoipd

dhcp6 run DHCPv6 client

Additional feature is multi-method configurations (methods can be delimited by ' ', ',' or '-':

dhcp-static try DHCP, if it fails, configure IPv4 static address(es). Implies static for IPv6.

dhcp6-static try DHCPv6, if it fails, configure IPv6 static address(es). Implies static for IPv4.

dhcp-ipv4ll same, but fallback to IPv4LL

dhcp-ipv4ll-static try DHCP, fallback to IPv4LL (very unlikely to fail), fallback to static

/etc/net will try to configure interface at the first succeeding method. Note that etcnet will process routes and rules despite of BOOTPROTO.

ONBOOT

Defines if the interface will be automatically brought up during system startup or 'service network start' invocation.

USE_HOTPLUG

If set to yes, iface will be skipped during boot. Note that standard hotplug calls /sbin/ifup and /sbin/ifdown. This should be changed to /etc/net/scripts/ifup-removable and /etc/net/scripts/ifdown-removable respectively, if you wish to use etcnet from hotplug.

USE_PCMCIA

Same for pcmcia_cs

CONFIG_IPV4, CONFIG_IPV6, CONFIG_IPX

These boolean options define, if you want to perform configuration of particular protocol or not.

CONFIG_QOS

This boolean function enables Linux QoS configuration. This topic is explained in etcnet-qos manpage.

CONFIG_DOT1X

This boolean option enables wired 802.1x authentication.

CONFIG_WIRELESS

This boolean option enables wireless extensions configuration.

CONFIG_FW

This boolean option enables firewall configuration. This topic is explained in README.firewall file.

KEEP_UP

If set to yes, an interface will not be set DOWN while ifdown is invoked. This can be suitable for loopback interfaces.

KEEP_DOWN

If set to yes, an interface will not be set UP, but configured. You are unlikely to need this option enabled.

DONT_FLUSH

IPv4/IPv6. Don't flush existing addresses from interface before assigning new ones. Also don't flush addresses on deconfiguration.

IFUP_CHILDREN

If set to yes, this variable will cause ifup call for all child (having current interface in their REQUIRES list) after the current interface is set up.

IFUP_PARENTS

If set to yes, this variable will cause ifup call for all parent (listed in current REQUIRES list) before the current interface is set up. Note: this will not work for ifplugd-controlled interfaces.

IFDOWN_CHILDREN

If set to yes, this variable will cause ifdown call for all child (having current interface in their REQUIRES list) before the current interface is shut down.

IFDOWN_PARENTS

If set to yes, this variable will cause ifdown call for all parent (listed in current REQUIRES list) after the current interface is shut down. Note: this will not work for ifplugd-controlled interfaces.

Ethernet options

MODULE

Kernel module name (or quoted list of names), which must be loaded before interface initialisation.

USE_IFPLUGD

A special configuration method. The interface will be created, but no configuration will be done until cable is plugged in. When ifplugd detects cable presence on the interface, it will run ifup-ifplugd to finish configuration. Values: no: don't use this feature yes: manage ifplugd for each such interface auto: same as 'yes', if ifplugd is available and the card supports link detection

PERSISTENT_IFPLUGD

Two operational modes are possible with USE_IFPLUGD=auto: persistent ifplugd (ifplugd will be run once and then only suspended/resumed when needed) and temporary ifplugd (ifplugd will be killed at ifdown and started at ifup each time). Default mode is to keep persistent ifplugd process.

IFPLUGD_EXTRA_ARGS

/etc/net will construct ifplugd arg list automatically, but you can add extra args with this option.

LINKDETECT

LINKDETECT option allows to avoid DHCP/IPv4LL timeout, if ethernet cable is not plugged in during startup. This feature requires ifplugstatus and is off by default, because not all network cards report correct link status. Possible values are: yes/no/auto. link status, LINKDETECT feature will take effect.

LINKDELAY

Some Ethernet interface modules require significant time to negotiate link parameters upon loading. Once the initial negitiation is complete, they indicate further link state changes correctly. This option specifies maximum number of seconds allowed for a module to report link absence before giving up and deciding, that the link is really absent. If the module reports link before timeout expires, it will be seen without spending all the time waiting.

MACADDR_WAITTIME

Some network card modules create network device first, then perform some initialization and after some time fill in MAC address data. Hotplug starts working immediately after the interface is created. If this variable is set to non-zero, /etc/net will wait for specified amount of 0.1 sec times for MAC address to become not 00:00:00:00:00:00. WARNING: THIS IS EXPERIMENTAL FEATURE !!!

IWCONFIG

Optional path to iwconfig.

WPA_SUPPLICANT

Optional path to wpa_supplicant.

WPA_DRIVER

Optional WPA driver name to pass to wpa_supplicant.

DHCP_CLIENT

Full path to DHCP client. Currently dhclient and dhcpcd are recognized and command-line options list built appropriately.

DHCP_TIMEOUT

Optional DHCP client timeout in seconds.

DHCP_ARGS

Optional additional DHCP client arguments.

DHCP_HOSTNAME

Possible values: 'localhost' (compute a valid hostname and send it to DHCP server with -h option); 'NONE' (don't send anything); any other string (send the string as a hostname with -h).

IP tunnels options

TUNTYPE

IP tunnel type: 'ipip' (default), 'gre' or 'sit'.

TUNLOCAL

Local tunnel endpoint.

TUNREMOTE

Remote tunnel endpoint.

TUNOPTIONS

Append whatever you want (TTL, GRE keys etc). Don't set 'dev' here.

HOST

Optional host interface. If set, this name will be used for 'dev' option.

IPSec tunnels options

At least one of cipher or digest must be configured.

CIPHERFILE and DIGESTFILE are searched in iface dir. If CIPHER is defined, CIPHERFILE must be defined too, same for DIGEST and DIGESTFILE.

IPSECADM

(Optional) location of ipsecadm.

TUNLOCAL

Local endpoint.

TUNREMOTE

Remote endpoint.

TUNSPI

SPI must be defined for an IPSec tunnel. SPI is a hexadecimal number, values less than 0x2000 are reserved.

CIPHER

Cipher name.

CIPHERFILE

Dipher file name.

DIGEST

Digest name.

DIGESTFILE

Digest file name.

HOST

"ipsecadm --nextdev" argument

VLAN options

HOST

Required parent iface name.

VID

Required VLAN ID.

VLAN_REORDER_HDR

This option allows changing the REORDER_HDR flag for each VLAN interface. The flag can be either "yes" or "no" and its meaning is described in vconfig manpage.

VXLAN options

HOST

Required parent iface name.

VNI

Required VXLAN Network Identifer (or VXLAN Segment Identifier).

LOCAL

Required source IP address to use in outgoing packets.

REMOTE

Specifies the unicast destination IP address to use in outgoing packets when the destination link layer address is not known in the VXLAN device forwarding database. This parameter cannot be specified with the group parameter.

GROUP

Specifies the multicast IP address to join. This parameter cannot be specified with the remote parameter.

DSTPORT

Specifies the UDP destination port to communicate to the remote VXLAN tunnel endpoint.

TTL

Specifies the TTL value to use in outgoing packets.

DVB options

DVBTYPE

This is a mandatory option. Currently supported values are: ss223 for SkyStar-2 rev. 2.3, ss226 for SkyStar-2 rev. 2.6, pentanet for Pent@NET, pentaval for Pent@VALUE

SkyStar-2 options

PID

SZAP

SZAP_ARGS

DVBNET

CHANNELS_CONF

For SkyStar cards you can override channels.conf location (default is channels.conf in the interface's configuration directory.

Pent@NET options

PENTANETT

pentanett location

PENTANET_CONF

Config file name.

Pent@VALUE options

PENTAVALT

pentavalt location

PENTAVAL_CONF

config file name

Bonding options

HOST

BONDMODE

Operation mode (optional). Possible values: 0 for round robin (default), 1 for active-backup, 2 for xor, 3 for broadcast, 4 for IEEE 802.3ad Dynamic link aggregation.

BONDOPTIONS

Additional options. This will have effect per interface. The list from modinfo bond is:

miimon:int: Link check interval in milliseconds

updelay:int: Delay before considering link up, in milliseconds

downdelay:int: Delay before considering link down, in milliseconds

use_carrier:int: Use netif_carrier_ok (vs MII ioctls) in miimon; 0 for off, 1 for on (default)

primary:string: Primary network device to use

lacp_rate:string: LACPDU tx rate to request from 802.3ad partner (slow/fast)

arp_interval:int: arp interval in milliseconds

arp_ip_target:string array (min = 1, max = 16): arp targets in n.n.n.n form

Bridge options

HOST

This variable must be defined for each bridge interface. This is a (quoted) space-separated list of slave ethernet interfaces combining the bridge. Don't forget to create configurations for the slave interfaces too.

BRIDGE_OPTIONS

Additional options. See ip-link(8) manpage for details.

PPP options

This section assumes knowledge of pppd(8) manpage.

PPPTYPE

PPP subtype. Valid types are: dialup, pptp, pppoe. pptp and pptp types will benefit from correctly set REQIURES and respectively HOST variables. dialup subtype will add 'modem' to pppd options list.

PPTP_SERVER

For "pptp" subtype you must specify hostname or IP address of PPtP server you connect to. Otherwise leave PPPTYPE=dialup.

HOST

pppoe client requires target interface name. You must specify it in the HOST variable, create-ppp will automatically construct correct pty option for pppd. This option is mandatory if PPPTYPE=pppoe.

PPPOE

Optional pppoe path.

PPPOE_EXTRA_OPTIONS

PPTP

Optional pptp-client path.

PPTP_EXTRA_OPTIONS

PPPD

pppd location, optional

PPPOPTIONS

Additional pppd args. Note that interface-specific options file will override PPPOPTIONS from options-ppp, not append. WARNING! NEVER set "persist maxfail 0" for an interface with ONBOOT=yes, otherwise your host risks hanging forever.

CHAT

chat location, optional

CHATOPTIONS

chat options (timeout, verbose mode etc)

PPPOPTIONSFILE

PPPINITCHAT

PPPCONNECTCHAT

PPPDISCONNECTCHAT

RESTORE_DEFAULTROUTE

pppd does not save default route for us. We could save and restore it with ip-up/ip-down, but this option will do the trick for us.

PPPTIMEOUT

Your PPP link will not hang for more seconds, than specified here. /etc/net will pass according lcp-echo-interval and lcp-echo-failure options to pppd, if this options is set.


exabgp.conf

package: exabgp

title: exabgp.conf(5)

text:
# exabgp.conf(5)

## NAME
exabgp.conf — Configuration file controlling the BGP configuration for exabgp(1).

## DESCRIPTION
exabgp.conf specifies the BGP neighbor configuration for exabgp.

### CONFIGURATION FILE SYNTAX

```
template {
    neighbor <template-name> {
        <neighbor-configuration>;
        // Suitable for setting common attributes
        // shared by more than one actual neighbor.

        // Can use basically any of the attributes
	// in the below neighbor configuration
    }
}

// Most attributes / settings are optional

neighbor <ip-address> {
    description <text>;
    inherit <template-name>; // from previously defined template

    router-id <router-id>;
    host-name <hostname>;
    domain-name <domain-name>;

    local-address <ip-address>;
    local-as <asn>;
    peer-as <asn>;
    hold-time <seconds>;
    rate-limit <enable | disable>;
    manual-eor <truthvalue>;

    passive <truthvalue>;
    listen <ip-address>;

    group-updates <truthvalue>;
    auto-flush <truthvalue>;
    adj-rib-in <truthvalue>;
    adj-rib-out <truthvalue>;

    md5-password <md5-secret>;
    md5-base64 <auto | true | false>;
    md5-ip <ip-address>;

    capability {
        add-path <disable | send | receive | send/receive>;
        asn4 <enable | disable>;
        graceful-restart <time-in-seconds>;
        multi-session <enable | disable>;
        operational <enable | disable>;
        route-refresh <enable | disable>;
        extended-message <enable | disable>;
    }

    family {
        all; // default, or a list of the below
        minimal; // use AFI/SAFI required to announce routes in config
        ipv4 unicast;
        ipv4 multicast;
        ipv4 nlri-mpls;
        ipv4 mpls-vpn;
        ipv4 flow;
        ipv4 flow-vpn;
        ipv6 unicast;
        ipv6 flow;
        ipv6 flow-vpn;
    }

    nexthop {
        ipv4 unicast ipv6;
        ipv4 multicast ipv6;
        ipv4 mpls-vpn ipv6;
        ipv4 nlri-mpls ipv6;
        ipv6 unicast ipv4;
        ipv6 multicast ipv4;
        ipv6 mpls-vpn ipv4;
        ipv6 nlri-mpls ipv4;
    }

    add-path {
        ipv4 unicast;
        ipv4 multicast;
        ipv4 nlri-mpls;
        ipv4 mpls-vpn;
        ipv4 flow;
        ipv4 flow-vpn;
        ipv6 unicast;
        ipv6 flow;
        ipv6 flow-vpn;
    }

    api {
        processes [ <process-name-list> ];
    }

    static {
        route <ip-address>/<prefixlength> {
          next-hop <ip-address>; // only mandatory attribute
          origin ( IGP | EGP | INCOMPLETE );
          as-path [ <as-sequence-asn> | ( <as-set ) ];
          as-sequence;
          med <med>;
          aigp <aigp>;
          local-preference <preference>;
          atomic-aggregate;
          aggregator <asn>:<ip-address>;
          path-information <ip-address>;
          community ( <community> | [ <community> <community> ... ] );
          large-community ( <large-community> | [ <large-community> ... ] );
          originator-id <ip-address>;
          cluster-list ( <ip-address> | [ <ip-address> <ip-address> ... ] );
          extended-community ( <extended-community> |
                               [ <extended-community> ... ] );
          split /<prefixlength>;
          label ( <label> | [ <label> <label> ... ] );
          rd  <route-distinguisher>;
          watchdog <watchdog-name>;
          bgp-prefix-sid ( [<label-index-value>] |
             [ <label-index-value>, [ ( <srgb-base_1>,<srgb-range_1> ), ... ] ]);
          withdraw;
        }
        // or alternatively
        route <ip-address>/<prefixlength> <attribute-sequence>;
        // where <attribute-sequence> is a sequence of
        // any of the attributes above
    }

    flow {
        route <route-name> {
            rd <route-distinguisher>;
            next-hop <ip-address>; // for redirect-to-nexthop
            match {
                // one or more match terms
                source <ip-address>/<prefixlength>;
                destination <ip-address>/<prefixlength>;
                port <portnumber>;
                source-port <portnumber>;
                destination-port <portnumber-expression>;
                protocol [ udp | tcp ]; // IPv4 only
                next-header [ udp | tcp ]; // IPv6 only
                tcp-flags [ fin | syn | rst | push | ack | urg | ece | cwr | ns ];
                icmp-type [ echo-reply | echo-request | info-reply |
                            info-request | mask-reply | mask-request |
                            parameter-problem | redirect | router-advertisment |
                            router-solicit | source-quench | time-exceeded |
                            timestamp | timestamp-reply | unreachable ];
                icmp-code [ communication-prohibited-by-filtering |
                            destination-host-prohibited |
                            destination-host-unknown |
                            destination-network-unknown |
                            fragmentation-needed | host-precedence-violation |
                            ip-header-bad | network-unreachable |
                            network-unreachable-for-tos | port-unreachable |
                            redirect-for-host | redirect-for-network |
                            redirect-for-tos-and-host |
                            redirect-for-tos-and-net |
                            required-option-missing | source-host-isolated |
                            source-route-failed |
                            ttl-eq-zero-during-reassembly |
                            ttl-eq-zero-during-transit ];
                fragment [ dont-fragment | is-fragment |
                           first-fragment | last-fragment ];
                // fragment is IPv4 only, poorly tested
                dscp <dscp-value>;
                traffic-class <traffic-class>;
                packet-length <packet-length-expression>;
                flow-label <flow-label-expression>; // IPv6 only
            }
            then {
                // one action only
                accept;
                discard;
                rate-limit <ratelimit>;
                redirect ( <route-distinguisher> | <ip-address> );
                redirect-to-nexthop; // Ref. next-hop above
                redirect-to-nexthop-ietf <ip-address>;
                copy <ip-address>;
                mark <mark>;
                action ( sample | terminal | sample-terminal );
                community;
                large-community;
                extended-community;
            }
        }
    }

    l2vpn {
        vpls <site-name> {
            endpoint ( <vpls-endpoint> (integer) );
            offset ( <block-offset> (integer) );
            size ( <block-size> (integer) );
            base ( <label-base> (integer) );
            name <route-name>;

            next-hop <ip-address>;
            origin ( IGP | EGP | INCOMPLETE );
            as-path [ <as-sequence-asn> | ( <as-set ) ];
            med <med>;
            local-preference <preference>;

            rd <route-distinguisher>;
            community ( <community> | [ <community> <community> ... ] );
            large-community ( <large-community> |
                            [ <large-community> ... ] );

            originator-id <ip-address>;
            cluster-list [ <ip-address> <ip-address> ... ];
            // l2info: encaps:control-flag:mtu:site-preference
            extended-community ( <extended-community> |
                                 [ <extended-community> ... ] );
            withdraw;
        }
    }
}

process <process-name> {
    run <command>;
    encoding <text | json>;
}
```

Please note that multi-line sections really do need to be written as multiple lines: the first one ending in "{", and ending with a line with a "}" by itself.

## SEE ALSO
exabgp(1).

## CAVEATS
Default values ought to be documented. The functionality and semantics of the process / api ought to be documented. The healthcheck module of exabgp is perhaps deserved of its own man page.

branch: sisyphus


package: eza

title: eza_colors(5)

text:
# eza_colors(5)

## NAME
eza_colors — customising the file and UI colours of eza

## SYNOPSIS
The EZA_COLORS environment variable can be used to customise the colours that eza uses to highlight file names, file metadata, and parts of the UI.

You can use the dircolors program to generate a script that sets the variable from an input file, or if you don’t mind editing long strings of text, you can just type it out directly. These variables have the following structure:

- A list of key-value pairs separated by ‘=’, such as ‘*.txt=32’.

- Multiple ANSI formatting codes are separated by ‘;’, such as ‘*.txt=32;1;4’.

- Finally, multiple pairs are separated by ‘:’, such as ‘*.txt=32:*.mp3=1;35’.

The key half of the pair can either be a two-letter code or a file glob, and anything that’s not a valid code will be treated as a glob, including keys that happen to be two letters long.

For backwards compatibility EXA_COLORS environment variables is checked if EZA_COLORS is unset.

## EXAMPLES
EZA_COLORS="uu=0:gu=0"

Disable the “current user” highlighting

EZA_COLORS="da=32"

Turn the date column green

EZA_COLORS="Vagrantfile=1;4;33"

Highlight Vagrantfiles

EZA_COLORS="*.zip=38;5;125"

Override the existing zip colour

EZA_COLORS="*.md=38;5;121:*.log=38;5;248"

Markdown files a shade of green, log files a shade of grey

## LIST OF CODES
LS_COLORS can use these ten codes:

di

directories

ex

executable files

fi

regular files

pi

named pipes

so

sockets

bd

block devices

cd

character devices

ln

symlinks

or

symlinks with no target

EZA_COLORS can use many more:

oc

the permissions displayed as octal

ur

the user-read permission bit

uw

the user-write permission bit

ux

the user-execute permission bit for regular files

ue

the user-execute for other file kinds

gr

the group-read permission bit

gw

the group-write permission bit

gx

the group-execute permission bit

tr

the others-read permission bit

tw

the others-write permission bit

tx

the others-execute permission bit

su

setuid, setgid, and sticky permission bits for files

sf

setuid, setgid, and sticky for other file kinds

xa

the extended attribute indicator

sn

the numbers of a file’s size (sets nb, nk, nm, ng and nt)

nb

the numbers of a file’s size if it is lower than 1 KB/Kib

nk

the numbers of a file’s size if it is between 1 KB/KiB and 1 MB/MiB

nm

the numbers of a file’s size if it is between 1 MB/MiB and 1 GB/GiB

ng

the numbers of a file’s size if it is between 1 GB/GiB and 1 TB/TiB

nt

the numbers of a file’s size if it is 1 TB/TiB or higher

sb

the units of a file’s size (sets ub, uk, um, ug and ut)

ub

the units of a file’s size if it is lower than 1 KB/Kib

uk

the units of a file’s size if it is between 1 KB/KiB and 1 MB/MiB

um

the units of a file’s size if it is between 1 MB/MiB and 1 GB/GiB

ug

the units of a file’s size if it is between 1 GB/GiB and 1 TB/TiB

ut

the units of a file’s size if it is 1 TB/TiB or higher

df

a device’s major ID

ds

a device’s minor ID

uu

a user that’s you

uR

a user that’s root

un

a user that’s someone else

gu

a group that you belong to

gR

a group related to root

gn

a group you aren’t a member of

lc

a number of hard links

lm

a number of hard links for a regular file with at least two

ga

a new flag in Git

gm

a modified flag in Git

gd

a deleted flag in Git

gv

a renamed flag in Git

gt

a modified metadata flag in Git

gi

an ignored flag in Git

gc

a conflicted flag in Git

Gm

main branch of repo

Go

other branch of repo

Gc

clean branch of repo

Gd

dirty branch of repo

xx

“punctuation”, including many background UI elements

da

a file’s date

in

a file’s inode number

bl

a file’s number of blocks

hd

the header row of a table

lp

the path of a symlink

cc

an escaped character in a filename

bO

the overlay style for broken symlink paths

sp

special (not file, dir, mount, exec, pipe, socket, block device, char device, or link)

mp

a mount point

im

a regular file that is an image

vi

a regular file that is a video

mu

a regular file that is lossy music

lo

a regular file that is lossless music

cr

a regular file that is related to cryptography (ex: key or certificate)

do

a regular file that is a document (ex: office suite document or PDF)

co

a regular file that is compressed

tm

a regular file that is temporary (ex: a text editor’s backup file)

cm

a regular file that is a compilation artifact (ex: Java class file)

bu

a regular file that is used to build a project (ex: Makefile)

sc

a regular file that is source code

ic

the icon (this is optional, if not set the icon color matches the file name’s)

Sn

No security context on a file

Su

SELinux user

Sr

SELinux role

St

SELinux type

Sl

SELinux level

ff

BSD file flags

Values in EXA_COLORS override those given in LS_COLORS, so you don’t need to re-write an existing LS_COLORS variable with proprietary extensions.

## LIST OF STYLES
Unlike some versions of ls, the given ANSI values must be valid colour codes: eza won’t just print out whichever characters are given.

The codes accepted by eza are:

1

for bold

2

for dimmed

3

for italic

4

for underline

31

for red text

32

for green text

33

for yellow text

34

for blue text

35

for purple text

36

for cyan text

37

for white text

90

for dark gray text

91

for bright red text

92

for bright green text

93

for bright yellow text

94

for bright blue text

95

for bright purple text

96

for bright cyan text

97

for bright text

38;5;nnn

for a colour from 0 to 255 (replace the nnn part)

Many terminals will treat bolded text as a different colour, or at least provide the option to.

eza provides its own built-in set of file extension mappings that cover a large range of common file extensions, including documents, archives, media, and temporary files. Any mappings in the environment variables will override this default set: running eza with LS_COLORS="*.zip=32" will turn zip files green but leave the colours of other compressed files alone.

You can also disable this built-in set entirely by including a reset entry at the beginning of EZA_COLORS. So setting EZA_COLORS="reset:*.txt=31" will highlight only text files; setting EZA_COLORS="reset" will highlight nothing.

## AUTHOR
eza is maintained by Christina Sørensen and many other contributors.

Source code: https://github.com/eza-community/eza

Contributors: https://github.com/eza-community/eza/graphs/contributors

Our infinite thanks to Benjamin ‘ogham’ Sago and all the other contributors of exa, from which eza was forked.

## SEE ALSO

- eza(1)

- eza_colors-explanation(5)


title: eza_colors-explanation(5)

summary: explanation \(em more details on customizing eza colors

text:
# eza_colors-explanation(5)

## Name
eza_colors-explanation — more details on customizing eza colors

## Eza Color Explanation
eza provides its own built-in set of file extension mappings that cover a large range of common file extensions, including documents, archives, media, and temporary files. Any mappings in the environment variables will override this default set: running eza with LS_COLORS="*.zip=32" will turn zip files green but leave the colours of other compressed files alone.

You can also disable this built-in set entirely by including a reset entry at the beginning of EZA_COLORS. So setting EZA_COLORS="reset:*.txt=31" will highlight only text files; setting EZA_COLORS="reset" will highlight nothing.

### Examples

- Disable the “current user” highlighting: EZA_COLORS="uu=0:gu=0"

- Turn the date column green: EZA_COLORS="da=32"

- Highlight Vagrantfiles: EZA_COLORS="Vagrantfile=1;4;33"

- Override the existing zip colour: EZA_COLORS="*.zip=38;5;125"

- Markdown files a shade of green, log files a shade of grey: EZA_COLORS="*.md=38;5;121:*.log=38;5;248"

### BUILT-IN EXTENSIONS

- eza now supports bright colours! As supported by most modern 256-colour terminals, you can now choose from bright colour codes when selecting your custom colours in your #EZA_COLORS environment variable.

- Build (Makefile, Cargo.toml, package.json) are yellow and underlined.

- Images (png, jpeg, gif) are purple.

- Videos (mp4, ogv, m2ts) are a slightly purpler purple.

- Music (mp3, m4a, ogg) is a faint blue.

- Lossless music (flac, alac, wav) is a less faint blue.

- Cryptographic files (asc, enc, p12) are bright green.

- Documents (pdf, doc, dvi) are a fainter green.

- Compressed files (zip, tgz, Z) are red.

- Temporary files (tmp, swp, ~) are dimmed default foreground color.

- Compiled files (class, o, pyc) are yellow. A file is also counted as compiled if it uses a common extension and is in the same directory as one of its source files: styles.css will count as compiled when next to styles.less or styles.sass, and scripts.js when next to scripts.ts or scripts.coffee.

- Source files (cpp, js, java) are bright yellow.

### Theme Configuration file
Now you can specify these options and more in a theme.yml file with convenient syntax for defining your styles.

Set EZA_CONFIG_DIR to specify which directory you would like eza to look for your theme.yml file, otherwise eza will look for $XDG_CONFIG_HOME/eza/theme.yml.

These are the available options:

## LIST OF THEME OPTIONS

```
filekinds:

  normal

  directory

  symlink

  pipe

  block_device

  char_device

  socket

  special

  executable

  mount_point
perms:

  user_read

  user_write

  user_execute_file

  user_execute_other

  group_read

  group_write

  group_execute

  other_read

  other_write

  other_execute

  special_user_file

  special_other

  attribute
size:

  major

  minor

  number_byte

  number_kilo

  number_mega

  number_giga

  number_huge

  unit_byte

  unit_kilo

  unit_mega

  unit_giga

  unit_huge
users:

  user_you

  user_root

  user_other

  group_yours

  group_other

  group_root
links:

  normal

  multi_link_file
git:

  new

  modified

  deleted

  renamed

  ignored

  conflicted
git_repo:

  branch_main

  branch_other

  git_clean

  git_dirty
security_context:

  none:

  selinux:

    colon

    user

    role

    typ

    range
file_type:

  image

  video

  music

  crypto

  document

  compressed

  temp

  compiled

  build

  source
punctuation:
date:
inode:
blocks:
header:
octal:
flags:
control_char:
broken_symlink:
broken_path_overlay:

```

Each of those fields/sub fields can have the following styling properties defined beneath it

```
    foreground: Blue

    background: null

    is_bold: false

    is_dimmed: false

    is_italic: false

    is_underline: false

    is_blink: false

    is_reverse: false

    is_hidden: false

    is_strikethrough: true

    prefix_with_reset: false

```

Example:

```
file_type:

  image:

    foreground: Blue

    is_italic: true
date:

  foreground: White
security_context:

  selinux:

    role:

      is_hidden: true

```

Icons can now be customized as well in the filenames and extensions fields

```
filenames:
  # Just change the icon glyph

  Cargo.toml: {icon: {glyph: 🦀}}

  Cargo.lock: {icon: {glyph: 🦀}}
extensions:

  rs: {  filename: {foreground: Red}, icon: {glyph: 🦀}}

```

NOTES:

Not all glyphs support changing colors.

If your theme is not working properly, double check the syntax in the config file, as a syntax issue can cause multiple properties to not be applied.

You must name the file theme.yml, no matter the directory you specify.

### See also

- eza(1)

- eza_colors(5)


jail.conf

title: jail.conf(5)

summary: configuration for the fail2ban server

text:
# jail.conf(5)

## NAME
jail.conf - configuration for the fail2ban server

## SYNOPSIS
fail2ban.conf fail2ban.d/*.conf fail2ban.local fail2ban.d/*.local

jail.conf jail.d/*.conf jail.local jail.d/*.local

action.d/*.conf action.d/*.local action.d/*.py

filter.d/*.conf filter.d/*.local

## DESCRIPTION
Fail2ban has four configuration file types:

fail2ban.conf

Fail2Ban global configuration (such as logging)

filter.d/*.conf

Filters specifying how to detect authentication failures

action.d/*.conf

Actions defining the commands for banning and unbanning of IP address

jail.conf

Jails defining combinations of Filters with Actions.

## CONFIGURATION FILES FORMAT
*.conf files are distributed by Fail2Ban. It is recommended that *.conf files should remain unchanged to ease upgrades. If needed, customizations should be provided in *.local files. For example, if you would like to enable the [ssh-iptables-ipset] jail specified in jail.conf, create jail.local containing

jail.local

[ssh-iptables-ipset] enabled = true

In .local files specify only the settings you would like to change and the rest of the configuration will then come from the corresponding .conf file which is parsed first.

jail.d/ and fail2ban.d/

In addition to .local, for jail.conf or fail2ban.conf file there can be a corresponding .d/ directory containing additional .conf files. The order e.g. for jail configuration would be:

jail.conf

jail.d/*.conf (in alphabetical order)

jail.local

jail.d/*.local (in alphabetical order). i.e. all .local files are parsed after .conf files in the original configuration file and files under .d directory. Settings in the file parsed later take precedence over identical entries in previously parsed files. Files are ordered alphabetically, e.g.

fail2ban.d/01_custom_log.conf - to use a different log path

jail.d/01_enable.conf - to enable a specific jail

jail.d/02_custom_port.conf - to change the port(s) of a jail.

Configuration files have sections, those specified with [section name], and name = value pairs. For those name items that can accept multiple values, specify the values separated by spaces, or in separate lines space indented at the beginning of the line before the second value.

Configuration files can include other (defining common variables) configuration files, which is often used in Filters and Actions. Such inclusions are defined in a section called [INCLUDES]:

before

indicates that the specified file is to be parsed before the current file.

after

indicates that the specified file is to be parsed after the current file.

Using Python "string interpolation" mechanisms, other definitions are allowed and can later be used within other definitions as %(name)s.

Fail2ban has more advanced syntax (similar python extended interpolation). This extended interpolation is using %(section/parameter)s to denote a value from a foreign section.

Besides cross section interpolation the value of parameter in [DEFAULT] section can be retrieved with %(default/parameter)s.

Fail2ban supports also another feature named %(known/parameter)s (means last known option with name parameter). This interpolation makes possible to extend a stock filter or jail regexp in .local file (opposite to simply set failregex/ignoreregex that overwrites it), e.g.

```
baduseragents = IE|wget|%(my-settings/baduseragents)s
failregex = %(known/failregex)s

            useragent=%(baduseragents)s
```

Additionally to interpolation %(known/parameter)s, that does not works for filter/action init parameters, an interpolation tag <known/parameter> can be used (means last known init definition of filters or actions with name parameter). This interpolation makes possible to extend a parameters of stock filter or action directly in jail inside jail.conf/jail.local file without creating a separately filter.d/*.local file, e.g.

\# filter.d/test.conf:

```
[Init]
test.method = GET
baduseragents = IE|wget
[Definition]
failregex = ^%(__prefix_line)\s+"<test.method>"\s+test\s+regexp\s+-\s+useragent=(?:<baduseragents>)
# jail.local:
[test]
# use filter "test", overwrite method to "POST" and extend known bad agents with "badagent":
filter = test[test.method=POST, baduseragents="badagent|<known/baduseragents>"]
```

Comments: use '#' for comment lines and '; ' (space is important) for inline comments.

## FAIL2BAN CONFIGURATION FILE(S) (fail2ban.conf)
The items that can be set in section [Definition] are:

loglevel

verbosity level of log output: CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG, TRACEDEBUG, HEAVYDEBUG or corresponding numeric value (50-5). Default: INFO (equal 20)

logtarget

log target: filename, SYSLOG, STDERR or STDOUT. Default: STDOUT if not set in fail2ban.conf/fail2ban.local

Note. If fail2ban running as systemd-service, for logging to the systemd-journal, the logtarget could be set to STDOUT

Only a single log target can be specified. If you change logtarget from the default value and you are using logrotate -- also adjust or disable rotation in the corresponding configuration file (e.g. /etc/logrotate.d/fail2ban on Debian systems).

socket

socket filename. Default: /var/run/fail2ban/fail2ban.sock

This is used for communication with the fail2ban server daemon. Do not remove this file when Fail2ban is running. It will not be possible to communicate with the server afterwards.

pidfile

PID filename. Default: /var/run/fail2ban/fail2ban.pid

This is used to store the process ID of the fail2ban server.

allowipv6

option to allow IPv6 interface - auto, yes (on, true, 1) or no (off, false, 0). Default: auto

This value can be used to declare fail2ban whether IPv6 is allowed or not.

dbfile

Database filename. Default: /var/lib/fail2ban/fail2ban.sqlite3

This defines where the persistent data for fail2ban is stored. This persistent data allows bans to be reinstated and continue reading log files from the last read position when fail2ban is restarted. A value of None disables this feature.

dbmaxmatches

Max number of matches stored in database per ticket. Default: 10

This option sets the max number of matched log-lines could be stored per ticket in the database. This also affects values resolvable via tags <ipmatches> and <ipjailmatches> in actions.

dbpurgeage

Database purge age in seconds. Default: 86400 (24hours)

This sets the age at which bans should be purged from the database.

The config parameters of section [Thread] are:

stacksize

Stack size of each thread in fail2ban. Default: 0 (platform or configured default)

This specifies the stack size (in KiB) to be used for subsequently created threads, and must be 0 or a positive integer value of at least 32.

## JAIL CONFIGURATION FILE(S) (jail.conf)
The following options are applicable to any jail. They appear in a section specifying the jail name or in the [DEFAULT] section which defines default values to be used if not specified in the individual section.

filter

name of the filter -- filename of the filter in /etc/fail2ban/filter.d/ without the .conf/.local extension.

Only one filter can be specified.

logpath

filename(s) of the log files to be monitored, separated by new lines.

Globs -- paths containing * and ? or [0-9] -- can be used however only the files that exist at start up matching this glob pattern will be considered. Optional space separated option 'tail' can be added to the end of the path to cause the log file to be read from the end, else default 'head' option reads file from the beginning

Ensure syslog or the program that generates the log file isn't configured to compress repeated log messages to "*last message repeated 5 time*s" otherwise it will fail to detect. This is called RepeatedMsgReduction in rsyslog and should be Off.

logencoding

encoding of log files used for decoding. Default value of "auto" uses current system locale.

logtimezone

Force the time zone for log lines that don't have one. If this option is not specified, log lines from which no explicit time zone has been found are interpreted by fail2ban in its own system time zone, and that may turn to be inappropriate. While the best practice is to configure the monitored applications to include explicit offsets, this option is meant to handle cases where that is not possible.

The supported time zones in this option are those with fixed offset: Z, UTC[+-]hhmm (you can also use GMT as an alias to UTC).

This option has no effect on log lines on which an explicit time zone has been found. Examples:

```
        logtimezone = UTC

        logtimezone = UTC+0200

        logtimezone = GMT-0100
```

banaction

banning action (default iptables-multiport) typically specified in the [DEFAULT] section for all jails.

This parameter will be used by the standard substitution of action and can be redefined central in the [DEFAULT] section inside jail.local (to apply it to all jails at once) or separately in each jail, where this substitution will be used.

banaction_allports

the same as banaction but for some "allports" jails like "pam-generic" or "recidive" (default iptables-allports).

action

action(s) from /etc/fail2ban/action.d/ without the .conf/.local extension.

Arguments can be passed to actions to override the default values from the [Init] section in the action file. Arguments are specified by:

[name=value,name2=value,name3="values,values"]

Values can also be quoted (required when value includes a ","). More that one action can be specified (in separate lines).

ignoreself

boolean value (default true) indicates the banning of own IP addresses should be prevented

ignoreip

list of IPs not to ban. They can include a DNS resp. CIDR mask too. The option affects additionally to ignoreself (if true) and don't need to contain own DNS resp. IPs of the running host.

ignorecommand

command that is executed to determine if the current candidate IP for banning (or failure-ID for raw IDs) should not be banned. This option operates alongside the ignoreself and ignoreip options. It is executed first, only if neither ignoreself nor ignoreip match the criteria.

IP will not be banned if command returns successfully (exit code 0). Like ACTION FILES, tags like <ip> are can be included in the ignorecommand value and will be substituted before execution.

ignorecache

provide cache parameters (default disabled) for ignore failure check (caching of the result from ignoreip, ignoreself and ignorecommand), syntax:

```
        ignorecache = key="<F-USER>@<ip-host>", max-count=100, max-time=5m

        ignorecommand = if [ "<F-USER>" = "technical" ] && [ "<ip-host>" = "my-host.example.com" ]; then exit 0; fi;

                        exit 1
```

This will cache the result of ignorecommand (does not call it repeatedly) for 5 minutes (cache time) for maximal 100 entries (cache size), using values substituted like "user@host" as cache-keys. Set option ignorecache to empty value disables the cache.

bantime

effective ban duration (in seconds or time abbreviation format).

findtime

time interval (in seconds or time abbreviation format) before the current time where failures will count towards a ban.

maxretry

number of failures that have to occur in the last findtime seconds to ban the IP.

backend

backend to be used to detect changes in the logpath.

It defaults to "auto" which will try "pyinotify", "systemd" before "polling". Any of these can be specified. "pyinotify" is only valid on Linux systems with the "pyinotify" Python libraries.

usedns

use DNS to resolve HOST names that appear in the logs. By default it is "warn" which will resolve hostnames to IPs however it will also log a warning. If you are using DNS here you could be blocking the wrong IPs due to the asymmetric nature of reverse DNS (that the application used to write the domain name to log) compared to forward DNS that fail2ban uses to resolve this back to an IP (but not necessarily the same one). Ideally you should configure your applications to log a real IP. This can be set to "yes" to prevent warnings in the log or "no" to disable DNS resolution altogether (thus ignoring entries where hostname, not an IP is logged)..

prefregex

regex (Python regular expression) to parse a common part containing in every message (see prefregex in section FILTER FILES for details).

failregex

regex (Python regular expression) to be added to the filter's failregexes (see failregex in section FILTER FILES for details). If this is useful for others using your application please share you regular expression with the fail2ban developers by reporting an issue (see REPORTING BUGS below).

ignoreregex

regex which, if the log line matches, would cause Fail2Ban not consider that line. This line will be ignored even if it matches a failregex of the jail or any of its filters.

maxmatches

max number of matched log-lines the jail would hold in memory per ticket. By default it is the same value as maxretry of jail (or default). This option also affects values resolvable via tag <matches> in actions.

### Backends
Available options are listed below.

pyinotify

requires pyinotify (a file alteration monitor) to be installed. If pyinotify is not installed, Fail2ban will use auto.

polling

uses a polling algorithm which does not require external libraries.

systemd

uses systemd python library to access the systemd journal. Specifying logpath is not valid for this backend and instead utilises journalmatch from the jails associated filter config. Multiple systemd-specific flags can be passed to the backend, including journalpath and journalfiles, to explicitly set the path to a directory or set of files. journalflags, which by default is 4 and excludes user session files, can be set to include them with journalflags=1, see the python-systemd documentation for other settings and further details. Examples:

```
backend = systemd[journalpath=/run/log/journal/machine-1]
backend = systemd[journalfiles="/path/to/system.journal, /path/to/user.journal"]
backend = systemd[journalflags=1]
```

### Actions
Each jail can be configured with only a single filter, but may have multiple actions. By default, the name of a action is the action filename, and in the case of Python actions, the ".py" file extension is stripped. Where multiple of the same action are to be used, the actname option can be assigned to the action to avoid duplication e.g.:

```
[ssh-iptables-ipset]
enabled = true
action = smtp.py[dest=chris@example.com, actname=smtp-chris]

         smtp.py[dest=sally@example.com, actname=smtp-sally]
```

## TIME ABBREVIATION FORMAT
The time entries in fail2ban configuration (like findtime or bantime) can be provided as integer in seconds or as string using special abbreviation format (e. g. 600 is the same as 10m).

Abbreviation tokens:

```
years?, yea?, yy?
months?, mon?
weeks?, wee?, ww?
days?, da, dd?
hours?, hou?, hh?
minutes?, min?, mm?
seconds?, sec?, ss?
The question mark (?) means the optional character, so day as well as days can be used.
```

You can combine multiple tokens in format (separated with space resp. without separator), e. g.: 1y 6mo or 1d12h30m.

Note that tokens m as well as mm means minutes, for month use abbreviation mo or mon.

The time format can be tested using fail2ban-client:

```
fail2ban-client --str2sec 1d12h
```

## ACTION CONFIGURATION FILES (action.d/*.conf)
Action files specify which commands are executed to ban and unban an IP address.

Like with jail.conf files, if you desire local changes create an [actionname].local file in the /etc/fail2ban/action.d directory and override the required settings.

Action files have two sections, Definition and Init .

The [Init] section enables action-specific settings. In jail.conf/jail.local these can be overridden for a particular jail as options of the action's specification in that jail.

The following commands can be present in the [Definition] section.

actionstart

command(s) executed when the jail starts.

actionstop

command(s) executed when the jail stops.

actioncheck

command(s) ran before any other action. It aims to verify if the environment is still ok.

actionban

command(s) that bans the IP address after maxretry log lines matches within last findtime seconds.

actionunban

command(s) that unbans the IP address after bantime.

The [Init] section allows for action-specific settings. In jail.conf/jail.local these can be overwritten for a particular jail as options to the jail. The following are special tags which can be set in the [Init] section:

timeout

The maximum period of time in seconds that a command can executed, before being killed.

Commands specified in the [Definition] section are executed through a system shell so shell redirection and process control is allowed. The commands should return 0, otherwise error would be logged. Moreover if actioncheck exits with non-0 status, it is taken as indication that firewall status has changed and fail2ban needs to reinitialize itself (i.e. issue actionstop and actionstart commands). Tags are enclosed in <>. All the elements of [Init] are tags that are replaced in all action commands. Tags can be added by the fail2ban-client using the "set <JAIL> action <ACT>" command. <br> is a tag that is always a new line (\n).

More than a single command is allowed to be specified. Each command needs to be on a separate line and indented with whitespace(s) without blank lines. The following example defines two commands to be executed.

actionban = iptables -I fail2ban-<name> --source <ip> -j DROP

echo ip=<ip>, match=<match>, time=<time> >> /var/log/fail2ban.log

### Action Tags
The following tags are substituted in the actionban, actionunban and actioncheck (when called before actionban/actionunban) commands.

ip

IPv4 IP address to be banned. e.g. 192.168.0.2

failures

number of times the failure occurred in the log file. e.g. 3

ipfailures

As per failures, but total of all failures for that ip address across all jails from the fail2ban persistent database. Therefore the database must be set for this tag to function.

ipjailfailures

As per ipfailures, but total based on the IPs failures for the current jail.

time

UNIX (epoch) time of the ban. e.g. 1357508484

matches

concatenated string of the log file lines of the matches that generated the ban. Many characters interpreted by shell get escaped to prevent injection, nevertheless use with caution.

ipmatches

As per matches, but includes all lines for the IP which are contained with the fail2ban persistent database. Therefore the database must be set for this tag to function.

ipjailmatches

As per ipmatches, but matches are limited for the IP and for the current jail.

## PYTHON ACTION FILES
Python based actions can also be used, where the file name must be [actionname].py. The Python file must contain a variable Action which points to Python class. This class must implement a minimum interface as described by fail2ban.server.action.ActionBase, which can be inherited from to ease implementation.

## FILTER FILES (filter.d/*.conf)
Filter definitions are those in /etc/fail2ban/filter.d/*.conf and filter.d/*.local.

These are used to identify failed authentication attempts in log files and to extract the host IP address (or hostname if usedns is true).

Like action files, filter files are ini files. The main section is the [Definition] section.

There are several standard filter definitions used in the [Definition] section:

prefregex

is the regex (regular expression) to parse a common part containing in every message, which is applied after datepattern found a match, before the search for any failregex or ignoreregex would start.

If this regex doesn't match the process is starting immediately with next message and search for any failregex does not occur.

If prefregex contains <F-CONTENT>...</F-CONTENT>, the part of message enclosed between this tags will be extracted and herafter used as whole message for search with failregex or ignoreregex.

For example:

```
        prefregex = ^%(__prefix_line)s (?:ERROR|FAILURE) <F-CONTENT>.+</F-CONTENT>$

        failregex = ^user not found

                    ^authentication failed

                    ^unknown authentication method
```

You can use prefregex in order to:

- specify 1 common regex to match some common part present in every messages (do avoid unneeded match in every failregex if you have more as one);

- to cut some interesting part of message only (to simplify failregex) enclosed between tags <F-CONTENT> and </F-CONTENT>;

- to gather some failure identifier (e. g. some prefix matched by <F-MLFID>...<F-MLFID/> tag) to identify several messages belonging to same session, where a connect message containing IP followed by failure message(s) that are not contain IP; this provides a new multi-line parsing method as replacement for old (slow an ugly) multi-line parsing using buffering window (maxlines > 1 and <SKIPLINES>);

- to ignore some wrong, too long or even unneeded messages (a.k.a. parasite log traffic) which can be also present in journal, before failregex search would take place.

failregex

is the regex (regular expression) that will match failed attempts. The standard replacement tags can be used as part of the regex:

<HOST> - common regex for IP addresses and hostnames (if usedns is enabled). Fail2Ban will work out which one of these it actually is.

<ADDR> - regex for IP addresses (both families).

<IP4> - regex for IPv4 addresses.

<IP6> - regex for IPv6 addresses.

<DNS> - regex to match hostnames.

<CIDR> - helper regex to match CIDR (simple integer form of net-mask).

<SUBNET> - regex to match sub-net addresses (in form of IP/CIDR, also single IP is matched, so part /CIDR is optional).

<F-ID>...</F-ID> - free regex capturing group targeting identifier used for ban (instead of IP address or hostname).

<F-*>...</F-*> - free regex capturing named group stored in ticket, which can be used in action.

```
For example <F-USER>[^@]+</F-USER> matches and stores a user name, that can be used in action with interpolation tag <F-USER>.
```

```
<F-ALT_*n>...</F-ALT_*n> - free regex capturing alternative named group stored in ticket.

For example first found matched value defined in regex as <F-ALT_USER>, <F-ALT_USER1> or <F-ALT_USER2> would be stored as <F-USER> (if direct match is not found or empty).
```

```
Every of abovementioned tags can be specified in prefregex and in failregex, thereby if specified in both, the value matched in failregex overwrites a value matched in prefregex.
```

All standard tags like IP4 or IP6 can be also specified with custom regex using <F-*>...</F-*> syntax, for example (?:ip4:<F-IP4>\S+</F-IP4>|ip6:<F-IP6>\S+</F-IP6>).

Tags <ADDR>, <HOST> and <SUBNET> would also match the IP address enclosed in square brackets.

```
NOTE: the failregex will be applied to the remaining part of message after prefregex processing (if specified), which in turn takes place after datepattern processing (whereby the string of timestamp matching the best pattern, cut out from the message).
```

```
For multiline regexs (parsing with maxlines greater that 1) the tag <SKIPLINES> can be used to separate lines. This allows lines between the matched lines to continue to be searched for other failures. The tag can be used multiple times.

This is an obsolete handling and if the lines contain some common identifier, better would be to use new handling (with tags <F-MLFID>...<F-MLFID/>).
```

```

```

ignoreregex

```
is the regex to identify log entries that should be ignored by Fail2Ban, even if they match failregex.

```

maxlines

```
specifies the maximum number of lines to buffer to match multi-line regexs. For some log formats this will not required to be changed. Other logs may require to increase this value if a particular log file is frequently written to.
```

datepattern

```
specifies a custom date pattern/regex as an alternative to the default date detectors e.g. %%Y-%%m-%%d %%H:%%M(?::%%S)?.
For a list of valid format directives, see Python library documentation for strptime behaviour.

NOTE: due to config file string substitution, that %'s must be escaped by an % in config files.

Also, special values of Epoch (UNIX Timestamp), TAI64N and ISO8601 can be used as datepattern.

Normally the regexp generated for datepattern additionally gets word-start and word-end boundaries to avoid accidental match inside of some word in a message.
There are several prefixes and words with special meaning that could be specified with custom datepattern to control resulting regex:
```

```
{DEFAULT} - can be used to add default date patterns of fail2ban.
```

```
{DATE} - can be used as part of regex that will be replaced with default date patterns.
```

```
{^LN-BEG} - prefix (similar to ^) changing word-start boundary to line-start boundary (ignoring up to 2 characters). If used as value (not as a prefix), it will also set all default date patterns (similar to {DEFAULT}), but anchored at begin of message line.
```

```
{UNB} - prefix to disable automatic word boundaries in regex.
```

```
{NONE} - value would allow one to find failures totally without date-time in log message. Filter will use now as a timestamp (or last known timestamp from previous line with timestamp).
```

journalmatch

```
specifies the systemd journal match used to filter the journal entries. See journalctl(1) and systemd.journal-fields(7) for matches syntax and more details on special journal fields. This option is only valid for the systemd backend.
```

```
Similar to actions, filters may have an [Init] section also (optional since v.0.10). All parameters of both sections [Definition] and [Init] can be overridden (redefined or extended) in jail.conf or jail.local (or in related filter.d/filter-name.local).
Every option supplied in the jail to the filter overwrites the value specified in [Init] section, which in turm would overwrite the value in [Definition] section.
Besides the standard settings of filter both sections can be used to initialize filter-specific options.
Filters can also have a section called [INCLUDES]. This is used to read other configuration files.
```

before

```
indicates that this file is read before the [Definition] section.

```

after

```
indicates that this file is read after the [Definition] section.

```

## AUTHOR
Fail2ban was originally written by Cyril Jaquier <cyril.jaquier@fail2ban.org>. At the moment it is maintained and further developed by Yaroslav O. Halchenko <debian@onerussian.com>, Daniel Black <daniel.subs@internode.on.net> and Steven Hiscocks <steven-fail2ban@hiscocks.me.uk> along with a number of contributors. See THANKS file shipped with Fail2Ban for a full list. Manual page written by Daniel Black and Yaroslav Halchenko.

## REPORTING BUGS
Report bugs to https://github.com/fail2ban/fail2ban/issues

## COPYRIGHT
Copyright © 2013 the Fail2Ban Team

Copyright of modifications held by their respective authors.

Licensed under the GNU General Public License v2 (GPL) or (at your option) any later version.

## SEE ALSO
fail2ban-server(1)


fapolicyd-filter.conf

package: fapolicyd

title: fapolicyd-filter.conf(5)

summary: fapolicyd filter configuration file

text:
# fapolicyd-filter.conf(5)

## NAME
fapolicyd-filter.conf - fapolicyd filter configuration file

## DESCRIPTION
The file /etc/fapolicyd/fapolicyd-filter.conf contains configuration of the filter for the application allowlisting daemon. This filter specifies an allow or exclude list of files from a trust source. Valid line starts with character '+', '-' or '#' for comments. The rest of the line contains a path specification. Space can be used as indentation to add more specific filters to the previous one. Note, that only one space is required for one level of an indent. If there are multiple specifications on the same indentation level they extend the previous line with lower indentation, usually a directory. The path may be specified using the glob pattern. A directory specification has to end with a slash ‘/’.

The filters are processed as follows: Starting from the up the to bottom while in case of a match the result (+/-) is set unless there is an indented block which describes more detailed specification of the parent level match. The same processing logic is applied to the inner filters definitions. If there is no match, the parent’s result is set. If there is no match at all, the default result is minus (-).

If the result was a plus (+), the respective file from a trust source is imported to the TrustDB. Vice versa, if the result was a minus (-), the respective file is not imported.

From a performance point of view it is better to design an indented filter because in the ideal situation each component of the path is compared only once. In contrast to it, a filter without any indentation has to contain a full path which makes the pattern more complicated and thus slower to process. The motivation behind this is to have a flexible configuration and keep the TrustDB as small as possible to make the look-ups faster.

```
# this is simple allow list
- /usr/bin/some_binary1
- /usr/bin/some_binary2
+ /
```

```
# this is the same
+ /
 + usr/bin/
  - some_binary1
  - some_binary2
```

```
# this is similar allow list with a wildcard
- /usr/bin/some_binary?
+ /
```

```
# this is similar with another wildcard
+ /
 - usr/bin/some_binary*
```

```
# keeps everything except usr/share except python and perl files
# /usr/bin/ls - result is '+'
# /usr/share/something - result is '-'
# /usr/share/abcd.py - result is '+'
+ /
 - usr/share/
  + *.py
  + *.pl
```

## SEE ALSO
fapolicyd(8), fapolicyd-cli(1) fapolicy.rules(5) and glob(7)

## AUTHOR
Radovan Sroka


fapolicyd.conf

title: fapolicyd.conf(5)

summary: fapolicyd configuration file

text:
# fapolicyd.conf(5)

## NAME
fapolicyd.conf - fapolicyd configuration file

## DESCRIPTION
The file /etc/fapolicyd/fapolicyd.conf contains configuration information for the application whitelisting daemon configuration. This file allows the admin to tune the performance and actions of the fapolicyd during runtime. This file contains one configuration keyword per line, an equal sign, and then followed by appropriate configuration information. All option names and values are case insensitive. The keywords recognized are listed and described below. Each line should be limited to 160 characters or the line will be skipped. You may add comments to the file by starting the line with a '#' character.

permissive

This option is either a 0 to mean send policy decisions to the kernel for enforcement. Or it can be a 1 to mean always allow the access even if policy would block it. This should only be used for policy testing and debug. The default value is 0.

nice_val

This option gives fapolicyd a scheduler boost. The number can be from 0 to 20. The default value is 10.

q_size

This option is used to control how big of an internal queue that fapolicyd will use. If requests come in faster than fapolicyd can answer, the queue holds the pending requests. If the do_stat_report is enabled, when fapolicyd shutsdown it will provide some statistics which includes maximum queue depth used. This information can be used to help tune performance. The default value is 800. Also note, this value means that fapolicyd gets a file descriptor for that entry. There is an rlimit cap controlled by systemd's LimitNOFILE setting for the service. You may also need to adjust it if the q_size exceeds it's value.

uid

This can be a number or an account name which fapolicyd should switch to during startup. The default value is 0 because it is guaranteed to exist. But it is recommended to use the fapolicyd account if that exists.

gid

This can be a number or an group name which fapolicyd should switch to during startup. The default value is 0 because it is guaranteed to exist. But it is recommended to use the fapolicyd group if that exists.

do_stat_report

This option controls whether (1) or not (0) fapolicyd should create a usage statistics report on shutdown. The report is written to /var/log/fapolicyd-access.log. This report gives information about number of allowed accesses and denials. Then for both the subject and object cache, it dumps information about size, hits, misses, and evictions. The default value is 1 which means create the report.

detailed_report

This option controls whether (1) or not (0) fapolicyd should add subject and object information to the usage statistics report. This would be information about the exact process or file path in the cache from most recently used to last recently used. This can be useful for forensics if an incident had occurred. But if the file names are sensitive then you may want to turn this off. The default value is 1 meaning add the details.

db_max_size

This option controls how many megabytes to allow the trust database to grow to. If you have lots of packages installed, then you want to make it bigger. The default value is 50 megabytes.

subj_cache_size

This option controls how many entries the subject cache holds. You want the size to be big enough that you are not getting too many evictions compared to hits. But you don't want to waste memory. Whenever there is an eviction, fapolicyd has to regenerate information about the subject and this slows performance. There are only 64k processes allowed at any time, so this would be the upper limit. The default value is 1549.

obj_cache_size

This option controls how many entries the object cache holds. You want the size to be big enough that you are not getting too many evictions compared to hits. But you don't want to waste memory. Whenever there is an eviction, fapolicyd has to regenerate information about the object and this slows performance. The default value is 8191.

watch_fs

This is a comma separated list of file systems that should be watched for access permission. No attempt is made to validate the file systems names. They should exactly match the name presented in the first column of /proc/mounts. If this is not configured, it will default to watching ext4, xfs, and tmpfs.

trust

This is a comma separated list of trust back-ends. If this is not configured, 'rpmdb,file' is default. Fapolicyd supports file back-end that reads content of /etc/fapolicyd/fapolicyd.trust and use it as a list of trusted files. The second option is rpmdb backend that generates list of trusted files from rpmdb.

integrity

This option tells fapolicyd which integrity strategy it should use. It can be one of 4 values:

none

This is the default and does no integrity checking.

size

Selecting this option will compare the size of the file with what it was knows to be. This is better than nothing and very fast since fapolicyd already collects size information during normal processing. However, an attacker could replace the file and as long as the size matches, it will not be detected.

ima

Selecting this option will use a SHA256 hash that the IMA subsystem places in a file's extended attributes in addition to the size check. This means that all file systems holding executable code must support extended attributes.

sha256

Selecting this option will calculate a SHA256 hash by cryptographic means. A size check will also be performed.

syslog_format

This option controls how the output from the access decision is formatted. The format is a comma separated list of subject and object names from the rules. It does not allow the keyword "all". It also allows for rule, dec, and perm. The format must include a semi-colon to delineate subject from object keywords. The typical use is to place information about the access decision, then subject information, a colon, and the object information. Also note that the more things being logged, the more it will impact system performance. Also, the event written is limited to 512 bytes. Example:

```
syslog_format = rule,dec,perm,auid,pid,exe,:,path,ftype,trust
```

rpm_sha256_only

The option set to 1 forces the daemon to work only with SHA256 hashes. This is useful on the systems where the integrity is set to SHA256 or IMA and some rpms were originally built with e.g. SHA1. The daemon will ignore these SHA1 entries therefore they can be added manually via CLI with correct SHA256 to a trust file later. If set to 0 the daemon stores SHA1 in trustdb as well. This is compatible with older behavior which works with the integrity set to NONE and SIZE. The NONE or SIZE integrity setting considers the files installed via rpm as trusted and it does not care about their hashes at all. On the other hand the integrity set to SHA256 or IMA will never consider a file with SHA1 in trustdb as trusted. The default value is 0.

allow_filesystem_mark

When this option is set to 1, it allows fapolicyd to monitor file access events on the underlying file system when they are bind mounted or are overlayed (e.g. the overlayfs). Normally they block fapolicyd from seeing events on the underlying file systems. This may or may not be desirable. For example, you might start seeing containers accessing things outside of the container but there is no source of trust for the container. In that case you probably do not want to see access from the container. Or maybe you do not use containers but want to control anything run by systemd-run when dynamic users are allowed. In that case you probably want to turn it on. Not all kernel's support this option. Therefore the default value is 0.

report_interval

This option specifies a reporting interval, measured in seconds, which fapolicyd uses to schedule a recurring dump of internal performance statistics to the fapolicyd.state file. The default value of 0 disables interval reporting.

## SEE ALSO
fapolicyd(8), fapolicyd-cli(8) and fapolicy.rules(5).

## AUTHOR
Steve Grubb


fapolicyd.rules

title: fapolicyd.rules(5)

text:
# fapolicyd.rules(5)

## NAME
compiled.rules - compiled fapolicyd rules to determine access rights fapolicyd.rules - deprecated fapolicyd rules to determine access rights

## DESCRIPTION
compiled.rules is a file that is compiled by fagenrules which contains the rules that fapolicyd uses to make decisions about access rights. The rules follow a simple format of:

```
decision perm subject : object
```

They are evaluated from top to bottom with the first rule to match being used for the access control decision. The colon is mandatory to separate subject and object since they share keywords.

### Decision
The decision is either allow, deny, allow_audit, deny_audit, allow_syslog, deny_syslog, allow_log, or deny_log. If the rule triggers, this is the access decision that fapolicyd will tell the kernel. If the decision is one of the audit variety, then the decision will trigger a FANOTIFY audit event with all relevant information. You must have at least one audit rule loaded to generate an audit event. If the decision is one of the syslog variety, then the decision will trigger writing an event into syslog. If the decision is of one the log variety, then it will create an audit event and a syslog event. Regardless of the notification, any rule with a deny in the keyword will deny access and any with an allow in the keyword will allow access.

### Perm
Perm describes what kind permission is being asked for. The permission is either open, execute, or any. If none are given, then open is assumed.

### Subject
The subject is the process that is performing actions on system resources. The fields in the rule that describe the subject are written in a name=value format. There can be one or more subject fields. Each field is and'ed with others to decide if a rule triggers. The name values can be any of the following:

all

This matches against any subject. When used, this must be the only subject in the rule.

auid

This is the login uid that the audit system assigns users when they log in to the system. Daemons have a value of -1. The given value may be numeric or the account name.

uid

This is the user id that the program is running under. The given value may be numeric or the account name.

gid

This is the group id that the program is running under. The given value may be numeric or the group name.

sessionid

This is the numeric session id that the audit system assigns to users when they log in. Daemons have a value of -1.

pid

This is the numeric process id that a program has.

ppid

This is the numeric process id of the program's parent. Note that programs that are orphaned or started directly from systemd have a ppid value of 1. Kernel threads have a ppid value of 2.

trust

This is a boolean describing whether it is required for the subject to be in the trust database or not. A value of 1 means its required while 0 means its not. Trust checking is extended by the integrity setting in fapolicyd.conf. When trust is used on the subject, it could be a daemon. If that daemon gets updated on disk, the trustdb will be updated to the new SHA256 hash. If the integrity setting is not none, the running daemon is not likely to be trusted unless it gets restarted. The default rules are not written in a way that this would happen. But this needs to be highlighted as it may not be obvious when writing a new rule.

comm

This is the shortened command name. When an interpreter starts a program, it usually renames the program to the script rather than the interpreter.

exe

This is the full path to the executable. Globbing is not supported. You may also use the special keyword untrusted to match on the subject not being listed in the rpm database.

dir

If you wish to match a directory, then use this by giving the full path to the directory. Its recommended to end with the / to ensure it matches a directory. There are 3 keywords that dir supports: execdirs, systemdirs, untrusted.

execdirs

The execdirs option will match against the following list of directories:

/usr/

/bin/ /sbin/ /lib/ /lib64/ /usr/libexec/

systemdirs

The systemdirs option will match against the same list as execdirs but also includes /etc/.

untrusted

The untrusted option will look up the current executable's full path in the rpm database to see if the executable is known to the system. The rule will trigger if the file in question is not in the trust database. This option is deprecated in favor of using obj_trust with execute permission when writing rules.

ftype

This option takes the mime type of a file as an argument. If you wish to check the mime type of a file while writing rules, run the following command:

```
fapolicyd-cli --ftype /path-to-file
```

device

This option will match against the device that the executable resides on. To use it, start with /dev/ and add the target device name.

pattern

There are various ways that an attacker may try to execute code that may reveal itself in the pattern of file accesses made during program startup. This rule can take one of several options depending on which access patterns is wished to be blocked. Fapolicyd is able to detect these different access patterns and provide the access decision as soon as it identifies the pattern. The pattern type can be any of:

normal

This matches against any ELF program that is dynamically linked.

ld_so

This matches against access patterns that indicate that the program is being started directly by the runtime linker.

ld_preload

This matches against access patterns that indicate that the program is being started with either LD_PRELOAD or LD_AUDIT present in the environment. Note that even without this rule, you have protection against LD_PRELOAD of unknown binaries when the rules are written such that trust is used to determine if a library should be opened. In that case, the preloaded library would be denied but the application will still execute. This rule makes it so that even trusted libraries can be denied and the application will not execute.

static

This matches against ELF files that are statically linked.

### Object
The object is the file that the subject is interacting with. The fields in the rule that describe the object are written in a name=value format. There can be one or more object fields. Each field is and'ed with others to decide if a rule triggers. The name values can be any of the following:

all

This matches against any obbject. When used, this must be the only object in the rule.

path

This is the full path to the file that will be accessed. Globbing is not supported. You may also use the special keyword untrusted to match on the object not being listed in the rpm database.

dir

If you wish to match on access to any file in a directory, then use this by giving the full path to the directory. Its recommended to end with the / to ensure it matches a directory. There are 3 keywords that dir supports: execdirs, systemdirs, untrusted. See the dir option under Subject for an explanation of these keywords.

device

This option will match against the device that the file being accessed resides on. To use it, start with /dev/ and add the target device name.

ftype

This option matches against the mime type of the file being accessed. See ftype under Subject for more information on determining the mime type.

trust

This is a boolean describing whether it is required for the object to be in the trust database or not. A value of 1 means its required while 0 means its not. Trust checking is extended by the integrity setting in fapolicyd.conf.

sha256hash

This option matches against the sha256 hash of the file being accessed. The hash in the rules should be all lowercase letters and do NOT start with 0x. Lowercase is the default output of sha256sum.

## SETS
Set is a named group of values of the same type. Fapolicyd internally distinguishes between INT and STRING set types. You can define your own set and use it as a value for a specific rule attribute. The definition is in key=value syntax and starts with a set name. The set name has to start with '%' and the rest is alphanumeric or '_'. The value is a comma separated list. The set type is inherited from the first item in the list. If that can be turned into number then whole list is expected to carry numbers. One can use these sets as a value for subject and object attributes. It is also possible to use a plain list as an attribute value without previous definition. The assigned set has to match the attribute type. It is not possible set groups for TRUST and PATTERN attributes.

### SETS EXAMPLES

```
# definition
%python=/usr/bin/python2.7,/usr/bin/python3.6
allow exe=%python : all trust=1
#
# definition
# number set
%uuids=0,1000
allow uid=%uuids : all
```

## NOTES
When writing rules, you should keep them focused to one goal and store them in one file. These rule files are kept in the /etc/fapolicyd/rules.d directory. During daemon startup, fagenrules will run and compile all these component files into one master file, compiled.rules. See the fagenrules man page for more information.

When you are writing a rule for the execute permission, remember that the file to be executed is an object. For example, you type ssh into the shell. The shell calls execve on /usr/bin/ssh. At that instant in time, ssh is the object that bash is working on. However, if you are blocking execution from a specific program, then you would normally state the program on the subject side and use all for the object side.

If you are writing rules that use patterns, just select any as the permission to be clear that this applies to anything. In reality, pattern matching ignores the permission but the suggestion is for documentation purposes.

Some interpreters do not immediately read all lines of input. Rather, they read content as needed until they get to end of file. This means that if they do stuff like networking or sleeping or anything that takes time, someone with the privileges to modify the file can add to it after the file's integrity has been checked. This is not unique to fapolicyd, it's simply how things work. Make sure that trusted file permissions are not excessive so that no unexpected file content modifications can occur.

## EXAMPLES
The following rules illustrate the rule syntax.

```
deny_audit perm=open exe=/usr/bin/wget : dir=/tmp
allow perm=open exe=/usr/bin/python3.7 : ftype=text/x-python trust=1
deny_audit perm=any pattern ld_so : all
deny perm=any all : all
```

## SEE ALSO
fapolicyd(8), fagenrules (8), fapolicyd-cli(8), and fapolicyd.conf(5)

## AUTHOR
Steve Grubb


fapolicyd.trust

title: fapolicyd.trust(5)

summary: fapolicyd's file of trust

text:
# fapolicyd.trust(5)

## NAME
fapolicyd.trust - fapolicyd's file of trust

## DESCRIPTION
The file /etc/fapolicyd/fapolicyd.trust contains list of trusted files/binaries for the application whitelisting daemon. You may add comments to the file by starting the line with a '#' character. Each line has to contain three columns and space is a valid separator. The first column contains full path to the file, the second is size of the file in bytes and the third is valid sha256 hash.

The directory /etc/fapolicyd/trust.d can be used to store multiple trust files. This way a privileged user can split the trust database into multiple files and manage them separately through fapolicyd-cli. Functionally, the fapolicy daemon will behave the same way as if the whole trust database has been defined inside fapolicyd.trust file. Syntax and semantics of trust files inside trust.d directory are the same as for fapolicyd.trust file (described above). Trust files can either be created manually inside trust.d directory or via fapolicyd-cli (the latter option is recommended).

## EXAMPLE

```
[root@Desktop ~]# cat /etc/fapolicyd/fapolicyd.trust
/home/user/my-ls 157984 61a9960bf7d255a85811f4afcac51067b8f2e4c75e21cf4f2af95319d4ed1b87
/home/user/my-ls2 5555 61a9960bf7d255a85811f4afcac51067b8f2e4c75e21cf4f2af95319d4ed1b87
```

## FILES
/etc/fapolicyd/fapolicyd.trust - list of trusted files/binaries

## SEE ALSO
fapolicyd(8), fapolicyd-cli(8) fapolicy.rules(5) and fapolicy.conf(5).

## AUTHOR
Radovan Sroka


rpm-filter.conf

title: rpm-filter.conf(5)

summary: fapolicyd filter configuration file

text:
# rpm-filter.conf(5)

## NAME
fapolicyd-filter.conf - fapolicyd filter configuration file

## DESCRIPTION
The file /etc/fapolicyd/rpm-filter.conf was migrated to /etc/fapolicyd/fapolicyd-filter.conf or see fapolicyd-filter.conf(5).

## SEE ALSO
fapolicyd(8), fapolicyd-cli(1) fapolicy.rules(5) and glob(7)

## AUTHOR
Radovan Sroka


fb.modes

package: fbset

title: fb.modes(5)

summary: frame buffer modes file

text:
# fb.modes(5)

## NAME
fb.modes - frame buffer modes file

## DESCRIPTION
/etc/fb.modes contains an unlimited number of video mode descriptions. The general format of a video mode is:

mode

geometry <xres> <yres> <vxres> <vyres> <depth>

timings <pixclock> <left> <right> <upper> <lower> <hslen> <vslen>

options <value>

rgba <red,green,blue,alpha>

endmode

## OPTIONS
geometry options:

xres

visible horizontal resolution (in pixels)

yres

visible vertical resolution (in pixels)

vxres

virtual horizontal resolution (in pixels)

vyres

virtual vertical resolution (in pixels)

depth

display depth (in bits per pixel)

timing options:

pixclock

length of one pixel (in picoseconds)

left

left margin (in pixels)

right

right margin (in pixels)

upper

upper margin (in pixel lines)

lower

lower margin (in pixel lines)

hslen

horizontal sync length (in pixels)

vslen

vertical sync length (in pixel lines)

rgba options (only valid with truecolor):

red

red color bitfields (in length or length/offset)

green

green color bitfields (in length or length/offset)

blue

blue color bitfields (in length or length/offset)

alpha

alpha color bitfields (in length or length/offset)

other options:

the first value of this options is the default hsync {low|high}

the horizontal sync polarity

vsync {low|high}

the vertical sync polarity

csync {low|high}

the composite sync polarity

gsync {low|high}

the sync on green polarity

bcast {false|true}

enable or disable broadcast modes. If enabled the frame buffer generates the exact timings fot several broadcast modes (e.g. PAL or NTSC). Note that this option may not be supported by every frame buffer

extsync {false|true}

enable or disable external resync. If enabled the sync timings are not generated by the frame buffer device and must be provided externally instead. Note that this option may not be supported by every frame buffer device

laced {false|true}

enable or disable interlace. If enabled the display will be split in two frames, each frame contains only even and odd lines respectively. These two frames will be displayed alternating, this way twice the lines can be displayed and the vertical frequency for monitor stays the same, but the visible vertical frequency gets halved

double {false|true}

enable or disable doublescan. If enabled every line will be displayed twice and this way the horizontal frequency can easily be doubled, so that the same resolution can be displayed on different monitors, even if the horizontal frequency specification differs. Note that this option may not be supported by every frame buffer device

nostd <number>

select nonstandard video mode

accel {false|true}

enable or disable hardware text acceleration

grayscale {false|true}

enable or disable graylevels instead of colors

## INTERNALS
Generally a frame buffer display is organized as follows:

+---+---------------+---+---+

| | ^ | | |

| | | 5 | | |

| | v | | |

+---#################---+---+

| # ^ # | |

| # | # | |

| # | # | |

| 1 # | 2 # 3 | 4 |

|<->#<------+------>#<->|<->|

| # | # | |

| # | 6 # | |

| # | # | |

| # v # | |

+---#################---+---+

| | ^ | | |

| | | 7 | | |

| | v | | |

+---+---------------+---+---+

| | ^ | | |

| | | 8 | | |

| | v | | |

+---+---------------+---+---+

1 left margin

2 xres

3 right margin

4 horizontal sync len

5 upper margin

6 yres

7 lower margin

8 vertical sync len

The area bordered with `#' is the visible display area. Horizontal and vertical frequencies can now easily be calculated, for this the sum of horizontal or vertical values are important

htotal = left + xres + right + hslen

vtotal = upper + yres + lower + vslen

The length of one line can now be calculated with pixclock line = pixclock * htotal

and we have the horizontal frequency hfreq = 1E12 / line = 1E12 / (pixclock * htotal)

To get the vertical frequency vtotal must eventually adjusted. If the display is laced, vtotal must be halved or if the display is a doublescan one, vtotal must be doubled. Now we can calculate the length of one frame if (lace) vtotal /= 2

if (double) vtotal *= 2

frame = vtotal * line

and we get also the vertical frequency vfreq = 1E12 / frame = hfreq / vtotal

## SEE ALSO
fbset(8), fbdev(4)