integritysetup

title: integritysetup(8)

summary: utility for configuring and managing dm\-integrity devices

text:
# integritysetup(8)

## NAME
integritysetup - utility for configuring and managing dm-integrity devices

## SYNOPSIS
integritysetup <action> [<options>] <action args>

## DESCRIPTION
Integritysetup is a utility for configuring and managing kernel dm-integrity devices.

Kernel device-mapper dm-integrity target emulates an additional data integrity tag per disk sector and provides transparent data integrity protection of block devices.

You can configure these additional integrity tags directly with integritysetup, or indirectly (for authenticated encryption) through LUKS2 and cryptsetup(8). Unlike dm-verity, dm-integrity devices support both read and write operations. The kernel performs data integrity checking transparently using a selected checksum or cryptographic hash algorithm.

Integrity devices can be activated during boot through integritytab(5), which is part of systemd(1).

## BASIC ACTIONS
Integritysetup supports these operations:

### FORMAT
format <device>

Formats <device> (calculates space and dm-integrity superblock and wipes the device).

<options> can be [--data-device, --batch-mode, --no-wipe, --journal-size, --interleave-sectors, --tag-size, --integrity, --integrity-key-size, --integrity-key-file, --sector-size, --progress-frequency, --progress-json].

### OPEN
open <device> <name>

create <name> <device> (OBSOLETE syntax)

Open a mapping with <name> backed by device <device>.

If the integrity algorithm of the device is non-default, then the algorithm should be specified with the --integrity option. This will not be detected from the device.

<options> can be [--data-device, --batch-mode, --journal-watermark, --journal-commit-time, --buffer-sectors, --integrity, --integrity-key-size, --integrity-key-file, --integrity-no-journal, --integrity-recalculate, --integrity-recalculate-reset,--integrity-recovery-mode, --allow-discards].

### CLOSE
close <name>

remove <name> (OBSOLETE syntax)

Removes existing mapping <name>.

<options> can be [--deferred] or [--cancel-deferred].

### STATUS
status <name>

Reports status for the active integrity mapping <name>.

### DUMP
dump <device>

Report parameters from the on-disk stored superblock.

### RESIZE
resize <name>

Resizes an active mapping <name>.

If --size (in 512-byte sectors) or --device-size is not specified, the size is computed from the underlying device. After resize, the recalculating flag is set. If --wipe flag is set and the size of the device is increased, the newly added section will be wiped.

Increasing the size of integrity volumes has been possible since the Linux kernel version 5.7; shrinking should work on older kernels, too.

<options> can be [--size, --device-size, --wipe].

## OPTIONS
--allow-discards

Allow the use of discard (TRIM) requests for the device. This option is available since the Linux kernel version 5.7.

--batch-mode, -q

Do not ask for confirmation.

--bitmap-flush-time ms

Bitmap flush time in milliseconds. WARNING: In case of a crash, it is possible that the data and integrity tag don’t match if the journal is disabled.

--bitmap-sectors-per-bit sectors

The number of 512-byte sectors per bitmap bit must be a power of two.

--buffer-sectors sectors

The number of sectors in one buffer. The tag area is accessed using buffers; the large buffer size means the I/O size will be larger, but there could be less I/Os issued.

--cancel-deferred

Removes a previously configured deferred device removal in the close command.

--data-device <data_device>

Specify a separate data device that contains existing data. The <device> will then contain calculated integrity tags and a journal for data on <data_device>. To not wipe the data device after initial format, also specify --no-wipe option and activate with --integrity-recalculate to recalculate integrity tags automatically.

--debug

Run in debug mode with full diagnostic logs. Debug output lines are always prefixed by #.

--deferred

Defers device removal in the close command until the last user closes it.

--help, -?

Show help text and default parameters.

--integrity, -I algorithm

Use internal integrity calculation (standalone mode). The integrity algorithm can be CRC (crc32c/crc32), a non-cryptographic hash function (xxhash64) or a hash function (sha1, sha256). For HMAC (hmac-sha256), you must specify an integrity key and its size.

--integrity-bitmap-mode, -B

Use alternate bitmap mode (available since Linux kernel 5.2), where dm-integrity uses a bitmap instead of a journal. If a bit in the bitmap is 1, the corresponding region’s data and integrity tags are not synchronized - if the machine crashes, the unsynchronized regions will be recalculated. The bitmap mode is faster than the journal mode because we don’t have to write the data twice. However, it is also less reliable because if data corruption happens when the machine crashes, it may not be detected.

--integrity-inline

Store integrity tags in hardware sector integrity fields. The device must support sectors with additional protection information (PI, also known as DIF - data integrity field) of the requested size. Another storage subsystem must not use the additional field (the device must present a "nop" profile in the kernel). Note that some devices must be reformatted at a low level to support this option; for NVMe devices, see nvme(1) id-ns LBA profiles. No journal or bitmap is used in this mode. The device should operate with native speed (without any overhead).

This option is available since the Linux kernel version 6.11.

--integrity-key-file file

The file with the integrity key.

--integrity-key-size bytes

The size of the data integrity key. Maximum is 4096 bytes.

--integrity-no-journal, -D

Disable the journal for the integrity device.

--integrity-recalculate

Automatically recalculate integrity tags in the kernel on activation. The device can be used during automatic integrity recalculation, but becomes fully integrity protected only after the background operation is finished. The primary intended use case is to skip initialization (wiping) of the data device after the initial format (see --no-wipe option). This parameter can be used for activation, then the kernel will recalculate integrity tags in the background. The integrity superblock contains a device offset that indicates the boundary to which the integrity tags are already updated. You can check this offset with the dump command.

--integrity-recalculate-reset

Restart recalculation from the beginning of the device. It can be used to change the integrity checksum function. Note, it does not change the tag length. This option is available since the Linux kernel version 5.13.

--integrity-recovery-mode, -R

Recovery mode (no journal, no tag checking).

--interleave-sectors sectors

The number of interleaved sectors.

--journal-commit-time ms

Commit time in milliseconds. The journal is written when this time passes (and no explicit flush operation was issued).

--journal-crypt algorithm

Encryption algorithm for the journal data area. You can use a block cipher here, such as cbc-aes or a stream cipher, for example, chacha20 or ctr-aes. The journal encryption options are only intended for testing. Using journal encryption does not make sense without encryption of the data.

--journal-crypt-key-file file

The file with the journal encryption key.

--journal-crypt-key-size bytes

The size of the journal encryption key. Maximum is 4096 bytes.

--journal-integrity algorithm

Integrity algorithm for the journal area. See --integrity option for detailed specification.

--journal-integrity-key-file file

The file with the integrity key.

--journal-integrity-key-size bytes

The size of the journal integrity key. Maximum is 4096 bytes.

--journal-size, -j bytes

Size of the journal.

--journal-watermark percent

Journal watermark in percent. When the journal size exceeds this watermark, the journal flush will be started.

--no-wipe

Do not wipe the device after formatting. A device that is not initially wiped will contain invalid checksums.

--progress-frequency seconds

Print a separate line every <seconds> with wipe progress.

--progress-json

Prints wipe progress data in JSON format, which is suitable mostly for machine processing. It prints a separate line every half second (or based on --progress-frequency value). The JSON output looks as follows during wipe progress (except it’s a compact single line):

```
{

  "device":"/dev/sda",      // backing device or file

  "device_bytes":"8192",    // bytes wiped so far

  "device_size":"44040192", // total bytes to wipe

  "speed":"126877696",      // calculated speed in bytes per second (based on progress so far)

  "eta_ms":"2520012",       // estimated time to finish wipe in milliseconds

  "time_ms":"5561235"       // total time spent wiping device in milliseconds
}
```

Note on numbers in JSON output: Due to JSON parsers' limitations, all numbers are represented in a string format due to the need for full 64-bit unsigned integers.

--sector-size, -s bytes

Sector size (power of two: 512, 1024, 2048, 4096).

--tag-size, -t bytes

Size of the integrity tag per-sector (here, the integrity function will store the authentication tag). The size can be smaller than the output size of the hash function; in that case, only part of the hash will be stored.

--usage

Show short option help.

--verbose, -v

Print more information on command execution.

--version, -V

Show the program version.

--wipe

Wipe the newly allocated area after resizing to a bigger size. If this flag is not set, checksums will be calculated for previously stored data in the newly allocated area.

## LEGACY COMPATIBILITY OPTIONS
Do not use these options until you need compatibility with a specific old kernel.

--integrity-legacy-padding

Use inefficient legacy padding.

--integrity-legacy-hmac

Use old flawed HMAC calculation (also does not protect superblock).

--integrity-legacy-recalculate

Allow insecure recalculating of volumes with HMAC keys (recalculation offset in superblock is not protected).

## RETURN CODES
Integritysetup returns 0 on success and a non-zero value on error.

Error codes are: 1 wrong parameters, 2 no permission, 3 out of memory, 4 wrong device specified, 5 device already exists or device is busy.

## NOTES
Format and activation of an integrity device always require superuser privilege because the superblock is calculated and handled in the dm-integrity kernel target.

## EXAMPLES
Format the device with default standalone mode (CRC32C):

integritysetup format <device>

Open the device with default parameters:

integritysetup open <device> test

Format the device in standalone mode for use with HMAC(SHA256):

integritysetup format <device> --tag-size 32 --integrity hmac-sha256 --integrity-key-file <keyfile> --integrity-key-size <key_bytes>

Open (activate) the device with HMAC(SHA256) and HMAC key in file:

integritysetup open <device> test --integrity hmac-sha256 --integrity-key-file <keyfile> --integrity-key-size <key_bytes>

Dump dm-integrity superblock information:

integritysetup dump <device>

## DM-INTEGRITY ON-DISK FORMAT
The on-disk format specification is available on the DMIntegrity <https://gitlab.com/cryptsetup/cryptsetup/wikis/DMIntegrity> page.

## AUTHORS
The integritysetup tool is written by Milan Broz <gmazyland@gmail.com>.

## REPORTING BUGS
Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach the output of the failed command with --debug option added.

## SEE ALSO
Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8)

## CRYPTSETUP
Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.


veritysetup

package: cryptsetup

title: veritysetup(8)

summary: utility for configuring and managing dm\-verity devices

text:
# veritysetup(8)

## NAME
veritysetup - utility for configuring and managing dm-verity devices

## SYNOPSIS
veritysetup <action> [<options>] <action args>

## DESCRIPTION
Veritysetup is a utility for configuring and managing kernel dm-verity devices.

Kernel device-mapper dm-verity target provides read-only transparent data integrity protection of block devices.

When you configure the dm-verity device, veritysetup creates a new mapping that applications can access like any regular storage device. The kernel performs the verification transparently by comparing each block against pre-computed cryptographic hashes. The verification uses a Merkle tree and happens transparently at the kernel level without affecting applications.

Verity devices can be activated during boot through veritytab(5), which is part of systemd(1).

## BASIC ACTIONS
Veritysetup supports these operations:

### FORMAT
format <data_device> <hash_device>

Calculates and permanently stores hash verification data for the data_device. Hash area can be located on the same device after data, if specified by --hash-offset option.

You need to provide the root hash string for device verification or activation. Root hash must be trusted.

The data or hash device argument can be a block device or a file image. If the hash device path doesn’t exist, it will be created as a file.

<options> can be [--hash, --no-superblock, --format, --data-block-size, --hash-block-size, --data-blocks, --hash-offset, --salt, --uuid, --root-hash-file].

If option --root-hash-file is used, the root hash is stored in hex-encoded text format in <path>.

### OPEN
open <data_device> <name> <hash_device> <root_hash>

open <data_device> <name> <hash_device> --root-hash-file <path>

create <name> <data_device> <hash_device> <root_hash> (OBSOLETE syntax)

Creates a mapping with <name> backed by device <data_device> and using <hash_device> for in-kernel verification.

The <root_hash> is a hexadecimal string.

<options> can be [--hash-offset, --no-superblock, --ignore-corruption or --restart-on-corruption, --panic-on-corruption, --ignore-zero-blocks, --check-at-most-once, --root-hash-signature, --root-hash-file, --use-tasklets, --shared].

If option --root-hash-file is used, the root hash is read from <path> instead of the command line parameter. Expects hex-encoded text, without a terminating newline.

If --no-superblock is used, you must use the same options as in the initial format operation.

### VERIFY
verify <data_device> <hash_device> <root_hash>

verify <data_device> <hash_device> --root-hash-file <path>

Verifies data on data_device using hash blocks stored on hash_device.

This command performs userspace verification; no kernel device is created.

The <root_hash> is a hexadecimal string.

If option --root-hash-file is used, the root hash is read from <path> instead of the command line parameter. Expects hex-encoded text, without a terminating newline.

<options> can be [--hash-offset, --no-superblock, --root-hash-file].

If --no-superblock is used, you must use the same options as in the initial format operation.

### CLOSE
close <name>

remove <name> (OBSOLETE syntax)

Removes existing mapping <name>.

<options> can be [--deferred] or [--cancel-deferred].

### STATUS
status <name>

Reports status for the active verity mapping <name>.

### DUMP
dump <hash_device>

Report parameters of the verity device from the on-disk stored superblock.

<options> can be [--hash-offset].

## OPTIONS
--batch-mode, -q

Do not ask for confirmation.

--cancel-deferred

Cancels a previously configured deferred device removal in the close command.

--check-at-most-once

Instruct the kernel to verify blocks only once they are read from the data device, rather than every time. WARNING: It provides a reduced level of security because only offline tampering of the data device’s content will be detected, not online tampering.

--data-blocks blocks

Size of the data device used in verification. If not specified, the whole device is used.

--data-block-size bytes

Used block size for the data device. Maximum is the page size used by the kernel.

--debug

Run in debug mode with full diagnostic logs. Debug output lines are always prefixed by #.

--deferred

Defers device removal in the close command until the last user closes it.

--error-as-corruption

Handle device I/O errors the same as data corruption. This option must be combined with --restart-on-corruption or --panic-on-corruption.

--fec-device device

Use forward error correction (FEC) to recover from corruption if hash verification fails. Use encoding data from the specified device. The FEC device argument can be a block device or a file image. For format, if the FEC device path doesn’t exist, it will be created as a file.

Block sizes for data and hash devices must match. Also, if the verity data_device is encrypted, the fec_device should be too.

FEC calculation covers data, hash area, and optional foreign metadata stored on the same device as the hash tree (additional space after the hash area). The size of this optional additional area protected by FEC is calculated from image sizes, so you must use the same images for activation.

If the hash device is in a separate image, metadata covers the entire image after the hash area.

The metadata ends on the FEC area offset if the hash and FEC device are in the image.

--fec-offset bytes

This is the offset, in bytes, from the start of the FEC device to the beginning of the encoding data.

--fec-roots number

Number of generator roots. This equals the number of parity bytes in the encoding data. In RS(M, N) encoding, the number of roots is M-N. M is 255, and M-N is between 2 and 24 (including).

--format number

Specifies the hash version type. Format type 0 is the original Chrome OS version. Format type 1 is the current version.

--hash hash

Hash algorithm for dm-verity. For default, see --help option.

--hash-block-size bytes

Used block size for the hash device. Maximum is the page size used by the kernel.

--hash-offset bytes

Offset of hash area/superblock on hash_device. Value must be aligned with the disk sector offset.

--help, -?

Show help text and default parameters.

--ignore-corruption, --restart-on-corruption, --panic-on-corruption

Defines what to do if a data integrity problem (data corruption) is detected. Without these options, the kernel fails the I/O operation with an I/O error. With --ignore-corruption option, the corruption is only logged. With --restart-on-corruption or --panic-on-corruption, the kernel is restarted (panicked) immediately. (You have to provide a way to avoid restart loops.)

Use these options only for very specific cases.

--ignore-zero-blocks

Instruct the kernel not to verify blocks expected to contain zeroes and always directly return zeroes instead. Use this option only in very specific cases.

--no-superblock

Create or use dm-verity without a permanent on-disk superblock.

--root-hash-file file*

Path to file with stored root hash in hex-encoded text.

--root-hash-signature file*

A path to the root hash signature file used to verify the root hash (in kernel). This feature requires a Linux kernel version 5.4 or more recent.

--salt=hex string

Salt used for formatting or verification. Format is a hexadecimal string.

--shared

Allows the data device to be used in shared mode. The data device is not checked for exclusive access before the device activation and may be mapped in multiple verity mappings.

--usage

Show short option help.

--use-tasklets

Try to use kernel tasklets in the dm-verity driver for performance reasons. This option is available since Linux kernel version 6.0.

--uuid UUID

Use the provided UUID for the format command instead of generating a new one. The UUID must be provided in standard UUID format, e.g., 12345678-1234-1234-1234-123456789abc.

--verbose, -v

Print more information on command execution.

--version, -V

Show the program version.

## RETURN CODES
Veritysetup returns 0 on success and a non-zero value on error.

Error codes are: 1 wrong parameters, 2 no permission, 3 out of memory, 4 wrong device specified, 5 device already exists or device is busy.

## EXAMPLES
veritysetup --data-blocks=256 format <data_device> <hash_device>

Calculates and stores verification data on hash_device for the first 256 blocks (of block size). If hash_device does not exist, it is created (as a file image).

veritysetup format --root-hash-file <path> <data_device> <hash_device>

Calculates and stores verification data on hash_device for the whole data_device, and stores the root hash as hex-encoded text in <path>.

veritysetup --data-blocks=256 --hash-offset=1052672 format <device> <device>

Verification data (hashes) is stored on the same device as data (starting at hash-offset). Hash offset must be greater than the number of blocks in the data area.

veritysetup --data-blocks=256 --hash-offset=1052672 create test-device <device> <device> <root_hash>

Activates the verity device named test-device. Options --data-blocks and --hash-offset are the same as in the format command. The <root_hash> was calculated in the format command.

veritysetup --data-blocks=256 --hash-offset=1052672 verify <data_device> <hash_device> <root_hash>

Verifies device without activation (in userspace).

veritysetup --data-blocks=256 --hash-offset=1052672 --root-hash-file <path> verify <data_device> <hash_device>

Verifies device without activation (in userspace). Root hash is passed via file rather than inline.

veritysetup --fec-device=<fec_device> --fec-roots=10 format <data_device> <hash_device>

Calculates and stores verification and encoding data for the data_device.

## DM-VERITY ON-DISK SPECIFICATION
The on-disk format specification is available on the DMVerity <https://gitlab.com/cryptsetup/cryptsetup/wikis/DMVerity> page.

## AUTHORS
The first implementation of veritysetup was written by Chrome OS authors.

This version is based on verification code written by Mikulas Patocka <mpatocka@redhat.com> and rewritten for libcryptsetup by Milan Broz <gmazyland@gmail.com>.

## REPORTING BUGS
Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach the output of the failed command with --debug option added.

## SEE ALSO
Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8)

## CRYPTSETUP
Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.

branch: sisyphus


cryptsetup-ssh

package: cryptsetup-ssh-token

title: cryptsetup-ssh(8)

summary: manage LUKS2 SSH token

text:
# cryptsetup-ssh(8)

## NAME
cryptsetup-ssh - manage LUKS2 SSH token

## SYNOPSIS
cryptsetup-ssh <action> [<options>] <action args>

## DESCRIPTION
Experimental cryptsetup plugin for unlocking LUKS2 devices with a token connected to an SSH server.

This plugin currently allows only adding a token to an existing keyslot. See cryptsetup(8) for instructions on how to remove, import or export the token.

### Add operation
add <options> <device>

Adds the SSH token to <device>.

The specified SSH server must contain a key file on the specified path with a passphrase for an existing keyslot on the device. Provided credentials will be used by cryptsetup to get the password when opening the device using the token.

Options --ssh-server, --ssh-user, --ssh-keypath and --ssh-path are required for this operation.

## OPTIONS
--debug

Show debug messages

--debug-json

Show debug messages including JSON metadata

--help, -?

Show help

--key-slot number

Keyslot to assign the token to. If not specified, the token will be assigned to the first keyslot matching the provided passphrase.

--ssh-keypath string

Path to the SSH key for connecting to the remote server.

--ssh-path string

Path to the key file on the remote server.

--ssh-server string

IP address/URL of the remote server for this token.

--ssh-user string

The username used for the remote server.

--verbose, -v

Shows more detailed error messages

--version, -V

Print program version

## NOTES
The information provided when adding the token (SSH server address, user and paths) will be stored in the LUKS2 header in plaintext.

## AUTHORS
The cryptsetup-ssh tool is written by Vojtech Trefny.

## REPORTING BUGS
Report bugs at cryptsetup mailing list <cryptsetup@lists.linux.dev> or in Issues project section <https://gitlab.com/cryptsetup/cryptsetup/-/issues/new>.

Please attach the output of the failed command with --debug option added.

## SEE ALSO
Cryptsetup FAQ <https://gitlab.com/cryptsetup/cryptsetup/wikis/FrequentlyAskedQuestions>

cryptsetup(8), integritysetup(8) and veritysetup(8)

## CRYPTSETUP
Part of cryptsetup project <https://gitlab.com/cryptsetup/cryptsetup/>.


cups-lpd

package: cups

title: cups-lpd(8)

text:
# cups-lpd(8)

## NAME
cups-lpd - receive print jobs and report printer status to lpd clients (deprecated)

## SYNOPSIS
cups-lpd [ -h hostname[:port] ] [ -n ] [ -o option=value ]

## DESCRIPTION
cups-lpd is the CUPS Line Printer Daemon ("LPD") mini-server that supports legacy client systems that use the LPD protocol. cups-lpd does not act as a standalone network daemon but instead operates using any of the Internet "super-servers" such as inetd(8), launchd(8), and systemd(8).

## OPTIONS
-h hostname[:port]

Sets the CUPS server (and port) to use.

-n

Disables reverse address lookups; normally cups-lpd will try to discover the hostname of the client via a reverse DNS lookup.

-o name=value

Inserts options for all print queues. Most often this is used to disable the "l" filter so that remote print jobs are filtered as needed for printing; the inetd(8) example below sets the "document-format" option to "application/octet-stream" which forces autodetection of the print file format.

## CONFORMING TO
cups-lpd does not enforce the restricted source port number specified in RFC 1179, as using restricted ports does not prevent users from submitting print jobs. While this behavior is different than standard Berkeley LPD implementations, it should not affect normal client operations.

The output of the status requests follows RFC 2569, Mapping between LPD and IPP Protocols. Since many LPD implementations stray from this definition, remote status reporting to LPD clients may be unreliable.

## ERRORS
Errors are sent to the system log.

## FILES

```
/etc/inetd.conf
/etc/xinetd.d/cups-lpd
/System/Library/LaunchDaemons/org.cups.cups-lpd.plist
```

## NOTES
The cups-lpd program is deprecated and will no longer be supported in a future feature release of CUPS.

### PERFORMANCE
cups-lpd performs well with small numbers of clients and printers. However, since a new process is created for each connection and since each process must query the printing system before each job submission, it does not scale to larger configurations. We highly recommend that large configurations use the native IPP support provided by CUPS instead.

### SECURITY
cups-lpd currently does not perform any access control based on the settings in cupsd.conf(5) or in the hosts.allow(5) or hosts.deny(5) files used by TCP wrappers. Therefore, running cups-lpd on your server will allow any computer on your network (and perhaps the entire Internet) to print to your server.

While xinetd(8) has built-in access control support, you should use the TCP wrappers package with inetd(8) to limit access to only those computers that should be able to print through your server.

cups-lpd is not enabled by the standard CUPS distribution. Please consult with your operating system vendor to determine whether it is enabled by default on your system.

## EXAMPLE
If you are using inetd(8), add the following line to the inetd.conf file to enable the cups-lpd mini-server:

```
    printer stream tcp nowait lp /usr/lib/cups/daemon/cups-lpd cups-lpd \

        -o document-format=application/octet-stream
```

CUPS includes configuration files for launchd(8), systemd(8), and xinetd(8). Simply enable the cups-lpd service using the corresponding control program.

## SEE ALSO
cups(1), cupsd(8), inetd(8), launchd(8), xinetd(8), CUPS Online Help (http://localhost:631/help), RFC 2569

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cups-snmp

title: cups-snmp(8)

summary: cups snmp backend (deprecated)

text:
# cups-snmp(8)

## NAME
snmp - cups snmp backend (deprecated)

## SYNOPSIS
/usr/lib/cups/backend/snmp ip-address-or-hostname

/usr/libexec/cups/backend/snmp ip-address-or-hostname

lpinfo -v --include-schemes snmp

## DESCRIPTION
The DEPRECATED CUPS SNMP backend provides legacy discovery and identification of network printers using SNMPv1. When used for discovery through the scheduler, the backend will list all printers that respond to a broadcast SNMPv1 query with the "public" community name. Additional queries are then sent to printers that respond in order to determine the correct device URI, make and model, and other information needed for printing.

In the first form, the SNMP backend is run directly by the user to look up the device URI and other information when you have an IP address or hostname. This can be used for programs that need to configure print queues where the user has supplied an address but nothing else.

In the second form, the SNMP backend is run indirectly using the lpinfo(8) command. The output provides all printers detected via SNMP on the configured broadcast addresses. Note: no broadcast addresses are configured by default.

## ENVIRONMENT
The DebugLevel value can be overridden using the CUPS_DEBUG_LEVEL environment variable. The MaxRunTime value can be overridden using the CUPS_MAX_RUN_TIME environment variable.

## FILES
The SNMP backend reads the /etc/cups/snmp.conf configuration file, if present, to set the default broadcast address, community name, and logging level.

## NOTES
The CUPS SNMP backend is deprecated and will no longer be supported in a future version of CUPS.

## CONFORMING TO
The CUPS SNMP backend uses the information from the Host, Printer, and Port Monitor MIBs along with some vendor private MIBs and intelligent port probes to determine the correct device URI and make and model for each printer.

## SEE ALSO
backend(7), cups-snmp.conf(5), cupsd(8), lpinfo(8), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsaccept

title: cupsaccept(8)

text:
# cupsaccept(8)

## NAME
cupsaccept/cupsreject - accept/reject jobs sent to a destination

## SYNOPSIS
cupsaccept [ -E ] [ -U username ] [ -h hostname[:port] ] destination(s)

cupsreject [ -E ] [ -U username ] [ -h hostname[:port] ] [ -r reason ] destination(s)

## DESCRIPTION
The cupsaccept command instructs the printing system to accept print jobs to the specified destinations.

The cupsreject command instructs the printing system to reject print jobs to the specified destinations. The -r option sets the reason for rejecting print jobs. If not specified, the reason defaults to "Reason Unknown".

## OPTIONS
The following options are supported by both cupsaccept and cupsreject:

-E

Forces encryption when connecting to the server.

-U username

Sets the username that is sent when connecting to the server.

-h hostname[:port]

Chooses an alternate server.

-r "reason"

Sets the reason string that is shown for a printer that is rejecting jobs.

## CONFORMING TO
The cupsaccept and cupsreject commands correspond to the System V printing system commands "accept" and "reject", respectively. Unlike the System V printing system, CUPS allows printer names to contain any printable character except SPACE, TAB, "/", or "#". Also, printer and class names are not case-sensitive.

Finally, the CUPS versions may ask the user for an access password depending on the printing system configuration.

## SEE ALSO
cancel(1), cupsenable(8), lp(1), lpadmin(8), lpstat(1),

CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsctl

title: cupsctl(8)

summary: configure cupsd.conf options

text:
# cupsctl(8)

## NAME
cupsctl - configure cupsd.conf options

## SYNOPSIS
cupsctl [ -h server[:port] ] [ -E ] [ -U username ] [ --[no-]debug-logging ] [ --[no-]remote-admin ] [ --[no-]remote-any ] [ --[no-]share-printers ] [ --[no-]user-cancel-any ] [ name=value ]

## DESCRIPTION
cupsctl updates or queries the cupsd.conf file for a server. When no changes are requested, the current configuration values are written to the standard output in the format "name=value", one per line.

## OPTIONS
The following options are recognized:

-E

Enables encryption on the connection to the scheduler.

-U username

Specifies an alternate username to use when authenticating with the scheduler.

-h server[:port]

Specifies the server address. Note: This option must occur before all others.

--[no-]debug-logging

Enables (disables) debug logging to the error_log file.

--[no-]remote-admin

Enables (disables) remote administration.

--[no-]remote-any

Enables (disables) printing from any address, e.g., the Internet.

--[no-]share-printers

Enables (disables) sharing of local printers with other computers.

--[no-]user-cancel-any

Allows (prevents) users to cancel jobs owned by others.

## EXAMPLES
Display the current settings:

```
    cupsctl
```

Enable debug logging:

```
    cupsctl --debug-logging
```

Get the current debug logging state:

```
    cupsctl | grep '^_debug_logging' | awk -F= '{print $2}'
```

Disable printer sharing:

```
    cupsctl --no-share-printers
```

## KNOWN ISSUES
You cannot set the Listen or Port directives using cupsctl.

## SEE ALSO
cupsd.conf(5), cupsd(8),

CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsd

title: cupsd(8)

summary: cups scheduler

text:
# cupsd(8)

## NAME
cupsd - cups scheduler

## SYNOPSIS
cupsd [ -c cupsd.conf ] [ -f ] [ -F ] [ -h ] [ -l ] [ -s cups-files.conf ] [ -t ]

## DESCRIPTION
cupsd is the scheduler for CUPS. It implements a printing system based upon the Internet Printing Protocol, version 2.1, and supports most of the requirements for IPP Everywhere. If no options are specified on the command-line then the default configuration file /etc/cups/cupsd.conf will be used.

## OPTIONS
-c cupsd.conf

Uses the named cupsd.conf configuration file.

-f

Run cupsd in the foreground; the default is to run in the background as a "daemon".

-F

Run cupsd in the foreground but detach the process from the controlling terminal and current directory. This is useful for running cupsd from init(8).

-h

Shows the program usage.

-l

This option is passed to cupsd when it is run from launchd(8) or systemd(8).

-s cups-files.conf

Uses the named cups-files.conf configuration file.

-t

Test the configuration file for syntax errors.

## FILES

```
/etc/cups/classes.conf
/etc/cups/cups-files.conf
/etc/cups/cupsd.conf
/usr/share/cups/mime/mime.convs
/usr/share/cups/mime/mime.types
/etc/cups/printers.conf
/etc/cups/subscriptions.conf
```

## CONFORMING TO
cupsd implements all of the required IPP/2.1 attributes and operations. It also implements several CUPS-specific administrative operations.

## EXAMPLES
Run cupsd in the background with the default configuration file:

```
    cupsd
```

Test a configuration file called test.conf:

```
    cupsd -t -c test.conf
```

Run cupsd in the foreground with a test configuration file called test.conf:

```
    cupsd -f -c test.conf
```

## SEE ALSO
backend(7), classes.conf(5), cups(1), cups-files.conf(5), cups-lpd(8), cupsd.conf(5), cupsd-helper(8), cupsd-logs(8), filter(7), launchd(8), mime.convs(5), mime.types(5), printers.conf(5), systemd(8), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsd-helper

title: cupsd-helper(8)

summary: cupsd helper programs (deprecated)

text:
# cupsd-helper(8)

## NAME
cupsd-helper - cupsd helper programs (deprecated)

## SYNOPSIS
cups-deviced request-id limit user-id options

cups-driverd cat ppd-name

cups-driverd list request_id limit options

cups-exec sandbox-profile [ -g group-id ] [ -n nice-value ] [ -u user-id ] /path/to/program argv0 ... argvN

## DESCRIPTION
The cupsd-helper programs perform long-running operations on behalf of the scheduler, cupsd(8). The cups-deviced helper program runs each CUPS backend(7) with no arguments in order to discover the available printers.

The cups-driverd helper program lists all available printer drivers, a subset of "matching" printer drivers, or a copy of a specific driver PPD file.

The cups-exec helper program runs backends, filters, and other programs. On macOS these programs are run in a secure sandbox.

## FILES
The cups-driverd program looks for PPD and driver information files in the following directories:

```
    /Library/Printers

    /opt/share/ppd

    /System/Library/Printers

    /usr/local/share/ppd

    /usr/share/cups/drv

    /usr/share/cups/model

    /usr/share/ppd
```

PPD files can be compressed using the gzip(1) program or placed in compressed tar(1) archives to further reduce their size.

Driver information files must conform to the format defined in ppdcfile(5).

## NOTES
CUPS printer drivers, backends, and PPD files are deprecated and will no longer be supported in a future feature release of CUPS. Printers that do not support IPP can be supported using applications such as ippeveprinter(1).

## SEE ALSO
backend(7), cups(1), cupsd(8), cupsd.conf(5), filter(7), ppdcfile(5), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsenable

title: cupsenable(8)

summary: stop/start printers and classes

text:
# cupsenable(8)

## NAME
cupsdisable, cupsenable - stop/start printers and classes

## SYNOPSIS
cupsdisable [ -E ] [ -U username ] [ -c ] [ -h server[:port] ] [ -r reason ] [ --hold ] destination(s)

cupsenable [ -E ] [ -U username ] [ -c ] [ -h server[:port] ] [ --release ] destination(s)

## DESCRIPTION
cupsenable starts the named printers or classes while cupsdisable stops the named printers or classes.

## OPTIONS
The following options may be used:

-E

Forces encryption of the connection to the server.

-U username

Uses the specified username when connecting to the server.

-c

Cancels all jobs on the named destination.

-h server[:port]

Uses the specified server and port.

--hold

Holds remaining jobs on the named printer. Useful for allowing the current job to complete before performing maintenance.

-r "reason"

Sets the message associated with the stopped state. If no reason is specified then the message is set to "Reason Unknown".

--release

Releases pending jobs for printing. Use after running cupsdisable with the --hold option to resume printing.

## CONFORMING TO
Unlike the System V printing system, CUPS allows printer names to contain any printable character except SPACE, TAB, "/", or "#". Also, printer and class names are not case-sensitive.

The System V versions of these commands are disable and enable, respectively. They have been renamed to avoid conflicts with the bash(1) built-in commands of the same names.

The CUPS versions of disable and enable may ask the user for an access password depending on the printing system configuration. This differs from the System V versions which require the root user to execute these commands.

## SEE ALSO
cupsaccept(8), cupsreject(8), cancel(1), lp(1), lpadmin(8), lpstat(1), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cupsfilter

title: cupsfilter(8)

text:
# cupsfilter(8)

## NAME
cupsfilter - convert a file to another format using cups filters (deprecated)

## SYNOPSIS
cupsfilter [ --list-filters ] [ -D ] [ -U user ] [ -c config-file ] [ -d printer ] [ -e ] [ -i mime/type ] [ -j job-id[,N] ] [ -m mime/type ] [ -n copies ] [ -o name=value ] [ -p filename.ppd ] [ -t title ] [ -u ] filename

## DESCRIPTION
cupsfilter is a front-end to the CUPS filter subsystem which allows you to convert a file to a specific format, just as if you had printed the file through CUPS. By default, cupsfilter generates a PDF file. The converted file is sent to the standard output.

## OPTIONS
--list-filters

Do not actually run the filters, just print the filters used to stdout.

-D

Delete the input file after conversion.

-U user

Specifies the username passed to the filters. The default is the name of the current user.

-c config-file

Uses the named cups-files.conf configuration file.

-d printer

Uses information from the named printer.

-e

Use every filter from the PPD file.

-i mime/type

Specifies the source file type. The default file type is guessed using the filename and contents of the file.

-j job-id[,N]

Converts document N from the specified job. If N is omitted, document 1 is converted.

-m mime/type

Specifies the destination file type. The default file type is application/pdf. Use printer/foo to convert to the printer format defined by the filters in the PPD file.

-n copies

Specifies the number of copies to generate.

-o name=value

Specifies options to pass to the CUPS filters.

-p filename.ppd

Specifies the PPD file to use.

-t title

Specifies the document title.

-u

Delete the PPD file after conversion.

## EXIT STATUS
cupsfilter returns a non-zero exit status on any error.

## ENVIRONMENT
All of the standard cups(1) environment variables affect the operation of cupsfilter.

## FILES

```
/etc/cups/cups-files.conf
/etc/cups/*.convs
/etc/cups/*.types
/usr/share/cups/mime/*.convs
/usr/share/cups/mime/*.types
```

## NOTES
CUPS printer drivers, filters, and backends are deprecated and will no longer be supported in a future feature release of CUPS. Printers that do not support IPP can be supported using applications such as ippeveprinter(1).

Unlike when printing, filters run using the cupsfilter command use the current user and security session. This may result in different output or unexpected behavior.

## EXAMPLE
The following command will generate a PDF preview of job 42 for a printer named "myprinter" and save it to a file named "preview.pdf":

```
    cupsfilter -m application/pdf -d myprinter -j 42 >preview.pdf
```

## SEE ALSO
cups(1), cupsd.conf(5), filter(7), mime.convs(7), mime.types(7), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


lpadmin

title: lpadmin(8)

summary: configure cups printers and classes

text:
# lpadmin(8)

## NAME
lpadmin - configure cups printers and classes

## SYNOPSIS
lpadmin [ -E ] [ -U username ] [ -h server[:port] ] -d destination

lpadmin [ -E ] [ -U username ] [ -h server[:port] ] -p destination [ -R name-default ] option(s)

lpadmin [ -E ] [ -U username ] [ -h server[:port] ] -x destination

## DESCRIPTION
lpadmin configures printer and class queues provided by CUPS. It can also be used to set the server default printer or class.

When specified before the -d, -p, or -x options, the -E option forces encryption when connecting to the server.

The first form of the command (-d) sets the default printer or class to destination. Subsequent print jobs submitted via the lp(1) or lpr(1) commands will use this destination unless the user specifies otherwise with the lpoptions(1) command.

The second form of the command (-p) configures the named printer or class. The additional options are described below.

The third form of the command (-x) deletes the printer or class destination. Any jobs that are pending for the destination will be removed and any job that is currently printed will be aborted.

## OPTIONS
The following options are recognized when configuring a printer queue:

-c class

Adds the named printer to class. If class does not exist it is created automatically.

-m model

Sets a standard PPD file for the printer from the model directory or using one of the driver interfaces. Use the -m option with the lpinfo(8) command to get a list of supported models. The model "raw" clears any existing PPD file and the model "everywhere" queries the printer referred to by the specified IPP device-uri. Note: Models other than "everywhere" are deprecated and will not be supported in a future version of CUPS.

-o cupsIPPSupplies=true

-o cupsIPPSupplies=false

Specifies whether IPP supply level values should be reported.

-o cupsSNMPSupplies=true

-o cupsSNMPSupplies=false

Specifies whether SNMP supply level (RFC 3805) values should be reported.

-o job-k-limit=value

Sets the kilobyte limit for per-user quotas. The value is an integer number of kilobytes; one kilobyte is 1024 bytes.

-o job-page-limit=value

Sets the page limit for per-user quotas. The value is the integer number of pages that can be printed; double-sided pages are counted as two pages.

-o job-quota-period=value

Sets the accounting period for per-user quotas. The value is an integer number of seconds; 86,400 seconds are in one day.

-o job-sheets-default=banner

-o job-sheets-default=banner,banner

Sets the default banner page(s) to use for print jobs.

-o name=value

Sets a PPD option for the printer. PPD options can be listed using the -l option with the lpoptions(1) command.

-o name-default=value

Sets a default server-side option for the destination. Any print-time option can be defaulted, e.g., "-o number-up-default=2" to set the default "number-up" option value to 2.

-o port-monitor=name

Sets the binary communications program to use when printing, "none", "bcp", or "tbcp". The default program is "none". The specified port monitor must be listed in the printer's PPD file.

-o printer-error-policy=name

Sets the policy for errors such as printers that cannot be found or accessed, don't support the format being printed, fail during submission of the print data, or cause one or more filters to crash. The name must be one of "abort-job" (abort the job on error), "retry-job" (retry the job at a future time), "retry-current-job" (retry the current job immediately), or "stop-printer" (stop the printer on error). The default error policy is "stop-printer" for printers and "retry-current-job" for classes.

-o printer-is-shared=true

-o printer-is-shared=false

Sets the destination to shared/published or unshared/unpublished. Shared/published destinations are publicly announced by the server on the LAN based on the browsing configuration in cupsd.conf, while unshared/unpublished destinations are not announced. The default value is "true".

-o printer-op-policy=name

Sets the IPP operation policy associated with the destination. The name must be defined in the cupsd.conf in a Policy section. The default operation policy is "default".

-R name-default

Deletes the named option from printer.

-r class

Removes the named printer from class. If the resulting class becomes empty it is removed.

-u allow:{user|@group}{,user|,@group}*

-u deny:{user|@group}{,user|,@group}*

-u allow:all

-u deny:none

Sets user-level access control on a destination. Names starting with "@" are interpreted as UNIX groups. The latter two forms turn user-level access control off. Note: The user 'root' is not granted special access - using "-u allow:foo,bar" will allow users 'foo' and 'bar' to access the printer but NOT 'root'.

-v "device-uri"

Sets the device-uri attribute of the printer queue. Use the -v option with the lpinfo(8) command to get a list of supported device URIs and schemes.

-D "info"

Provides a textual description of the destination.

-E

When specified before the -d, -p, or -x options, forces the use of TLS encryption on the connection to the scheduler. Otherwise, enables the destination and accepts jobs; this is the same as running the cupsaccept(8) and cupsenable(8) programs on the destination.

-L "location"

Provides a textual location of the destination.

## DEPRECATED OPTIONS
The following lpadmin options are deprecated:

-i filename

This option historically has been used to provide either a System V interface script or (as an implementation side-effect) a PPD file. Note: Interface scripts are not supported by CUPS. PPD files and printer drivers are deprecated and will not be supported in a future version of CUPS.

-P ppd-file

Specifies a PostScript Printer Description (PPD) file to use with the printer. Note: PPD files and printer drivers are deprecated and will not be supported in a future version of CUPS.

## CONFORMING TO
Unlike the System V printing system, CUPS allows printer names to contain any printable character except SPACE, TAB, "/", or "#". Also, printer and class names are not case-sensitive.

Finally, the CUPS version of lpadmin may ask the user for an access password depending on the printing system configuration. This differs from the System V version which requires the root user to execute this command.

## NOTES
CUPS printer drivers and backends are deprecated and will no longer be supported in a future feature release of CUPS. Printers that do not support IPP can be supported using applications such as ippeveprinter(1).

The CUPS version of lpadmin does not support all of the System V or Solaris printing system configuration options.

Interface scripts are not supported for security reasons.

The double meaning of the -E option is an unfortunate historical oddity.

The lpadmin command communicates with the scheduler (cupsd) to make changes to the printing system configuration. This configuration information is stored in several files including printers.conf and classes.conf. These files should not be edited directly and are an implementation detail of CUPS that is subject to change at any time.

## EXAMPLE
Create an IPP Everywhere print queue:

```
    lpadmin -p myprinter -E -v ipp://myprinter.local/ipp/print -m everywhere
```

## SEE ALSO
cupsaccept(8), cupsenable(8), lpinfo(8), lpoptions(1), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


lpc-cups

title: lpc-cups(8)

text:
# lpc-cups(8)

## NAME
lpc - line printer control program (deprecated)

## SYNOPSIS
lpc [ command [ parameter(s) ] ]

## DESCRIPTION
lpc provides limited control over printer and class queues provided by CUPS. It can also be used to query the state of queues.

If no command is specified on the command-line, lpc displays a prompt and accepts commands from the standard input.

### COMMANDS
The lpc program accepts a subset of commands accepted by the Berkeley lpc program of the same name:

exit

Exits the command interpreter.

help [command]

? [command]

Displays a short help message.

quit

Exits the command interpreter.

status [queue]

Displays the status of one or more printer or class queues.

## NOTES
This program is deprecated and will be removed in a future feature release of CUPS.

Since lpc is geared towards the Berkeley printing system, it is impossible to use lpc to configure printer or class queues provided by CUPS. To configure printer or class queues you must use the lpadmin(8) command or another CUPS-compatible client with that functionality.

## SEE ALSO
cancel(1), cupsaccept(8), cupsenable(8), lp(1), lpadmin(8), lpr(1), lprm(1), lpstat(1), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


lpinfo

title: lpinfo(8)

text:
# lpinfo(8)

## NAME
lpinfo - show available devices or drivers (deprecated)

## SYNOPSIS
lpinfo [ -h server[:port] ] [ -E ] [ -l ] [ --device-id device-id-string ] [ --exclude-schemes scheme-list ] [ --include-schemes scheme-list ] [ --language locale ] [ --make-and-model name ] [ --product name ] -m

lpinfo [ -h server[:port] ] [ -E ] [ -l ] [ --exclude-schemes scheme-list ] [ --include-schemes scheme-list ] [ --timeout seconds ] -v

## DESCRIPTION
lpinfo lists the available devices or drivers known to the CUPS server. The first form (-m) lists the available drivers, while the second form (-v) lists the available devices.

## OPTIONS
lpinfo accepts the following options:

-E

Forces encryption when connecting to the server.

-h server[:port]

Selects an alternate server. Note: This option must occur before all others.

-l

Shows a "long" listing of devices or drivers.

--device-id device-id-string

Specifies the IEEE-1284 device ID to match when listing drivers with the -m option.

--exclude-schemes scheme-list

Specifies a comma-delimited list of device or PPD schemes that should be excluded from the results. Static PPD files use the "file" scheme.

--include-schemes scheme-list

Specifies a comma-delimited list of device or PPD schemes that should be included in the results. Static PPD files use the "file" scheme.

--language locale

Specifies the language to match when listing drivers with the -m option.

--make-and-model name

Specifies the make and model to match when listing drivers with the -m option.

--product name

Specifies the product to match when listing drivers with the -m option.

--timeout seconds

Specifies the timeout when listing devices with the -v option.

## CONFORMING TO
The lpinfo command is unique to CUPS.

## EXAMPLES
List all devices:

```
    lpinfo -v
```

List all drivers:

```
    lpinfo -m
```

List drivers matching "HP LaserJet":

```
    lpinfo --make-and-model "HP LaserJet" -m
```

## NOTES
CUPS printer drivers and backends are deprecated and will no longer be supported in a future feature release of CUPS. Printers that do not support IPP can be supported using applications such as ippeveprinter(1).

## SEE ALSO
lpadmin(8), CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


lpmove

title: lpmove(8)

text:
# lpmove(8)

## NAME
lpmove - move a job or all jobs to a new destination

## SYNOPSIS
lpmove [ -h server[:port] ] [ -E ] [ -U username ] job destination

lpmove [ -h server[:port] ] [ -E ] [ -U username ] source destination

## DESCRIPTION
lpmove moves the specified job or all jobs from source to destination. job can be the job ID number or the old destination and job ID.

## OPTIONS
The lpmove command supports the following options:

-E

Forces encryption when connecting to the server.

-U username

Specifies an alternate username.

-h server[:port]

Specifies an alternate server. Note: This option must occur before all others.

## EXAMPLES
Move job 123 from "oldprinter" to "newprinter":

```
    lpmove 123 newprinter

            or

    lpmove oldprinter-123 newprinter
```

Move all jobs from "oldprinter" to "newprinter":

```
    lpmove oldprinter newprinter
```

## SEE ALSO
cancel(1), lp(1), lpr(1), lprm(1),

CUPS Online Help (http://localhost:631/help)

## COPYRIGHT
Copyright © 2020-2024 by OpenPrinting.


cups-browsed

package: cups-browsed

title: cups-browsed(8)

text:
# cups-browsed(8)

## NAME
cups-browsed - A daemon for browsing the Bonjour broadcasts of shared, remote CUPS printers

## SYNOPSIS

```
cups-browsed [-v | -d | --debug] [-c config-file]
[-o option=value] [-o 'config file line'] ...
[--autoshutdown=mode] [--autoshutdown-timeout=timeout]
[-h | --help | --version]
```

## DESCRIPTION
cups-browsed has two independently switchable functions:

1.

Browse DNS-SD broadcasts of remote printers and create/remove local CUPS queues pointing to these printers.

2.

Find shared printers on given CUPS servers and create local CUPS queues pointing to them.

cups-browsed can be run permanently (from system boot to shutdown) or on-demand (for example to save resources on mobile devices). For running it on-demand an auto-shutdown feature can be activated to let cups-browsed terminate when it does not have queues any more to take care of.

## OPTIONS
-v, -d, --debug

Debug mode, verbose logging to stderr

-l, --logfile

Debug logging into /var/log/cups/cups-browsed_log file.

-c config-file

Uses the alternative configuration file config-file instead of the standard one.

-o option=value, -o 'config file line'

Supply configuration options via the command line. You can supply any line which also could be put into the configuration file, but note that due to the spaces the line has to be put into quotes, or for a simple key/value pair the space between key and value can get replaced by '='. If command-line-supplied configuration settings are contradicting with the ones in the configuration file, the ones in the configuration file will get used.

--autoshutdown=mode

Auto shutdown mode, mode is off for no auto shutdown, on for auto shutdown being active, and avahi for control by the avahi-daemon being run on-demand, getting auto-shutdown turned off while avahi-daemon is present and on when avahi-daemon is shut down.

--autoshutdown-on=inactivity-type

What cups-browsed considers as inactivity for auto-shutdown. inactivity-type set to no-queues (the default) means that auto-shutdown is initiated if there are no queues generated by cups-browsed any more, no-jobs means that auto-shutdown will get initiated if all queues generated by cups-browsed are without jobs.

--autoshutdown-timeout=timeout

timeout tells after how many seconds cups-browsed should shut down if it has no local queues set up for any discovered remote printer any more or jobs on these. Default is 30 seconds. 0 means immediate shutdown.

-h, --help, --version

Display usage and version info and do not start the daemon.

## FILES
/etc/cups/cups-browsed.conf

## SIGNALS
SIGINT, SIGTERM: cups-browsed will shutdown.

SIGUSR1: Switches cups-browsed into permanent mode (no auto shutdown).

SIGUSR2: Switches cups-browsed into auto shutdown mode.

## NOTES
This manual page was written for the Debian Project, but it may be used by others.

## SEE ALSO
cups-browsed.conf(5)


cvsbug

package: cvs

title: cvsbug(8)

text:
# cvsbug(8)

## NAME
cvsbug - send problem report (PR) about CVS to a central support site

## SYNOPSIS
cvsbug [ site ] [ -f problem-report ] [ -t mail-address ]

[ -P ] [ -L ] [ --request-id ] [ -v ]

## DESCRIPTION
cvsbug is a tool used to submit problem reports (PRs) to a central support site. In most cases the correct site will be the default. This argument indicates the support site which is responsible for the category of problem involved. Some sites may use a local address as a default. site values are defined by using the aliases(5).

cvsbug invokes an editor on a problem report template (after trying to fill in some fields with reasonable default values). When you exit the editor, cvsbug sends the completed form to the Problem Report Management System (GNATS) at a central support site. At the support site, the PR is assigned a unique number and is stored in the GNATS database according to its category and submitter-id. GNATS automatically replies with an acknowledgement, citing the category and the PR number.

To ensure that a PR is handled promptly, it should contain your (unique) submitter-id and one of the available categories to identify the problem area. (Use `cvsbug -L' to see a list of categories.)

The cvsbug template at your site should already be customized with your submitter-id (running `install-sid submitter-id' to accomplish this is part of the installation procedures for cvsbug). If this hasn't been done, see your system administrator for your submitter-id, or request one from your support site by invoking `cvsbug --request-id'. If your site does not distinguish between different user sites, or if you are not affiliated with the support site, use `net' for this field.

The more precise your problem description and the more complete your information, the faster your support team can solve your problems.

## OPTIONS
-f problem-report

specify a file (problem-report) which already contains a complete problem report. cvsbug sends the contents of the file without invoking the editor. If the value for problem-report is `-', then cvsbug reads from standard input.

-t mail-address

Change mail address at the support site for problem reports. The default mail-address is the address used for the default site. Use the site argument rather than this option in nearly all cases.

-P

print the form specified by the environment variable PR_FORM on standard output. If PR_FORM is not set, print the standard blank PR template. No mail is sent.

-L

print the list of available categories. No mail is sent.

--request-id

sends mail to the default support site, or site if specified, with a request for your submitter-id. If you are not affiliated with site, use a submitter-id of net'.

-v

Display the cvsbug version number.

Note: use cvsbug to submit problem reports rather than mailing them directly. Using both the template and cvsbug itself will help ensure all necessary information will reach the support site.

## ENVIRONMENT
The environment variable EDITOR specifies the editor to invoke on the template.

default: vitmp

If the environment variable PR_FORM is set, then its value is used as the file name of the template for your problem-report editing session. You can use this to start with a partially completed form (for example, a form with the identification fields already completed).

## HOW TO FILL OUT A PROBLEM REPORT
Problem reports have to be in a particular form so that a program can easily manage them. Please remember the following guidelines:

- describe only one problem with each problem report.

- For follow-up mail, use the same subject line as the one in the automatic acknowledgement. It consists of category, PR number and the original synopsis line. This allows the support site to relate several mail messages to a particular PR and to record them automatically.

- Please try to be as accurate as possible in the subject and/or synopsis line.

- The subject and the synopsis line are not confidential. This is because open-bugs lists are compiled from them. Avoid confidential information there.

See the GNU Info file cvsbug.info or the document Reporting Problems With cvsbug for detailed information on reporting problems

## HOW TO SUBMIT TEST CASES, CODE, ETC.
Submit small code samples with the PR. Contact the support site for instructions on submitting larger test cases and problematic source code.

## FILES
$TMPDIR/p.XXXXXXXXXX copy of PR used in editing session

$TMPDIR/pf.XXXXXXXXXX copy of empty PR form, for testing purposes

$TMPDIR/pbad.XXXXXXXXXX file for rejected PRs

## INSTALLATION AND CONFIGURATION
See INSTALL for installation instructions.

## SEE ALSO
gnats(l), query-pr(1), edit-pr(1), gnats(8), queue-pr(8), at-pr(8), mkcat(8), mkdist(8).

## AUTHORS
Jeffrey Osier, Brendan Kehoe, Jason Merrill, Heinz G. Seidl (Cygnus Support)

## COPYING
Copyright (c) 1992, 1993 Free Software Foundation, Inc.

Permission is granted to make and distribute verbatim copies of this manual provided the copyright notice and this permission notice are preserved on all copies.

Permission is granted to copy and distribute modified versions of this manual under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.

Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions, except that this permission notice may be included in translations approved by the Free Software Foundation instead of in the original English.


cvs-pserver

package: cvs-pserver

title: cvs-pserver(8)

summary: The GNU Concurrent Versions System

text:
# cvs-pserver(8)

## NAME
cvs - The GNU Concurrent Versions System

## SYNOPSIS
cvs-pserver

## DESCRIPTION
cvs-pserver is a wrapper around CVS which loads some default variables. It should not need any configuration, and will usually be run from xinetd(8).

## FILES
/etc/cvs/pserver.conf

## SEE ALSO
cvs(1), xinetd(8).

## AUTHOR
This manual page was initially written by Tollef Fog Heen <tfheen@debian.org>, for the Debian GNU/Linux system.


cyclades-ser-cli

package: cyclades-serial-client

title: cyclades-ser-cli(8)

text:
# cyclades-ser-cli(8)

## NAME
cyclades-ser-cli-SerialPortInterfaceforCycladesTerminalServers

## SYNOPSIS
cyclades-ser-cli [options] devname rasname physport

## DESCRIPTION
The cyclades-ser-cli program connects a Unix device file 'devname' to a physical port 'physport' of a Cyclades Terminal Server 'rasname'. cyclades-ser-cli provides the I/O interface between the device file and the physical port, running as an 'user-mode device driver'.

If 'physport' is assigned to 0, then 'rasname' is used as the IP address on an IP-based serial port addressing.

## OPTIONS
cyclades-ser-cli may be started with the following options:

-u ptyiosize

Sets the internal device I/O size to ptyiosize (maximum 4096 bytes, default 1024 bytes)

-n netiosize

Sets the internal socket I/O size to netiosize (maximum 512 bytes, default 128 bytes)

-i retrydelay

Delay in seconds between connection requests (default: 60)

-r retries

Number of connection request retries before exiting. (default: infinity)

-s

Use the Socket Server protocol for talking to the server, this means just piping all the data down a TCP connection with no control information, so it's impossible to change the port speed etc. The default is to use the RFC2217 protocol.

-m modem handling

The default is 0 which means to check DCD state, 1 means to ignore DCD.

-c close mode

Last close handling; the default is 0 which means to hangup the modem, 1 means not to hangup.

-p start port

TCP base port of servers at terminal server side (defaults: 31000 for Socket server, 30000 for Remote Telnet Server). Note: if 'physport' is assigned to zero, this option has no effect, the Telnet Server standard port (23) is used.

-d debug level

The default is debug level 0 (little debugging), level 1 debugs internal state changes, level 2 debugs events, and level 3 debugs IO calls.

-f

Run in foreground, this is suitable for running from init.

-x

Console mode: normally all messages are sent to syslogd (using local2 facility). With this option, all messages will be sent to stdout and cyclades-ser-cli runs in the foreground. This implies -f

## USE
Every instance of cyclades-ser-cli will have a virtual serial device which is a sym-link to a pseudo-tty. A terminal program can then talk to the virtual serial device and it's data transfers will be redirected across the network. Each virtual serial device will be accompanied by a Unix domain socket with the same name with the addition of ".control". So if cyclades-ser-cli provides the virtual device named "/dev/modem" then it will have a control socket named "/dev/modem.control". There is a shared object named libcyclades-ser-cli.so which intercepts calls to the tcsetattr() and tcsendbreak(). This shared object then sends the relevant data to the cyclades-ser-cli server via the control socket. To recognise a virtual modem device it has to read /etc/cyclades-devices.

The libcyclades-ser-cli.so shared object can be loaded per-application through the LD_PRELOAD environment variable, or for the entire system through the system shared object configuration (see the OS documentation). Note that the LD_PRELOAD environment variable has to have the fully qualified path of the object, otherwise an application which changes it's current directory may fail.

## BUGS
In Solaris libcyclades-ser-cli.so does not work with the stty program. stty uses a different interface to this and requires some extra coding.

In Solaris libcyclades-ser-cli.so conflicts with some system programs such as ps for unknown reasons. Just don't load it for those programs, it has no such problems with any serial comms programs.

## EXAMPLES
Start an interface between /dev/prt1 device and a serial port number 10 of a Terminal Server named pr01, without hangup at last close:

cyclades-ser-cli -c 1 /dev/prt1 pr01 10

In general use do not start cyclades-ser-cli from the command line, start it through the cyclades-serial-client script or from init.

## SEE ALSO
cyclades-serial-client(1), cyclades-devices(5)


cyclades-serial-client

title: cyclades-serial-client(8)

text:
# cyclades-serial-client(8)

## NAME
cyclades-serial-client-SerialPortInterfaceforCycladesTerminalServers

## SYNOPSIS
cyclades-serial-client (start | stop | restart | status) [devname]

## DESCRIPTION
For each physical port listed in cyclades-devices file, cyclades-serial-client controls the status of the corresponding cyclades-ser-cli interface.

## OPTIONS
cyclades-serial-client must be invoked with one of the (start, stop, restart or status), and optionally with a argument associated to a specific device. In this case, the action spedified as the option will be performed only for this device.

If this argument was not supplied, the action will be performed for all devices listed in cyclades-devices file. The mandatory options are:

start

- Starts the cyclades-ser-cli program, using parameters supplied in the cyclades-devices file. If this program is already running, a message will be displayed, and no additional copy will be started.

stop

- Stops the cyclades-ser-cli program(s), by issuing a SIGTERM signal.

restart

- Simulates a hangup to cyclades-ser-cli program(s), by issuing a SIGUSR1 signal.

status

- Checks the status of cyclades-ser-cli programs(s).

## EXAMPLES
Assuming the the following cyclades-devices file configuration:

/dev/ctty01:pr3k:1:rtelnet: /dev/ctty02:pr3k:2:socket:

1 . Start all devices: cyclades-serial-client start Messages: "Starting /dev/ctty01 <==> pr3k:1 interface" "Starting /dev/ctty02 <==> pr3k:2 interface"

2 . Try to start them again: cyclades-serial-client start Messages: "cyclades-serial-client : /dev/ctty01 already active" "cyclades-serial-client : /dev/ctty02 already active"

3 . Stop only /dev/ctty01 device: cyclades-serial-client stop /dev/ctty01 Messages: "Stopping /dev/ctty01 <==> pr3k:2 interface"

4 . Checking status: cyclades-serial-client status Messages: "/dev/ctty01 (rtelnet at pr3k:1) is inactive" "/dev/ctty02 ( socket at pr3k:2) active, pid 2983"

5 . Start a non-valid device cyclades-serial-client start /dev/xtty01 Messages: "cyclades-serial-client : device /dev/xtty01 does not exist"

## SEE ALSO
cyclades-ser-cli(1), cyclades-devices(5)


pluginviewer

title: pluginviewer(8)

text:
# pluginviewer(8)

## NAME
pluginviewer - list loadable SASL plugins and their properties

## SYNOPSIS
pluginviewer [-a] [-s] [-c] [-b min=N,max=N] [-e ssf=N,id=ID] [-m MECHS] [-x AUXPROP_MECH] [-f FLAGS] [-p PATH]

## DESCRIPTION
pluginviewer can be used by a server administrator to troubleshoot SASL installations. The utility can list loadable (properly configured) client and server side plugins, as well as auxprop plugins.

## OPTIONS
-a

List auxprop plugins.

-s

List server authentication (SASL) plugins.

-c

List client authentication (SASL) plugins.

-b min=N1,max=N2

List client authentication (SASL) plugins. Strength of the SASL security layer in bits. min=N1 specifies the minimum strength to use (1 => integrity protection). max=N2 specifies the maximum strength to use. Only SASL mechanisms which support security layer with strength M such that N1 <= M <= N2 will be shown.

-e ssf=N,id=ID

Assume that an external security layer (e.g. TLS) with N-bit strength is installed. The ID is the authentication identity used by the external security layer.

-m MECHS

Limit listed SASL plugins to the ones included in the MECHS (space separated) list.

-x AUXPROP_MECHS

Limit listed auxprop plugins to the one listed in the AUXPROP_MECHS (space separated) list.

-f FLAGS

Set security flags. FLAGS is a comma separated list of one or more of the following security flags: noplain (SASL mechanism doesn´t send password in the clear during authentication), noactive (require protection from active attacks), nodict (require mechanisms which are secure against passive dictionary attacks), forwardsec (require forward secrecy), passcred (require mechanisms that can delegate client credentials), maximum (require all security flags).

-p PATH

Specifies a colon-separated search path for plugins.

## SEE ALSO
rfc4422 - Simple Authentication and Security Layer (SASL)


saslauthd

title: saslauthd(8)

summary: sasl authentication server

text:
# saslauthd(8)

## NAME
saslauthd — sasl authentication server

## SYNOPSIS
saslauthd

-a authmech [-Tvdchlr] [-O option] [-m mux_path] [-n threads] [-s size] [-t timeout]

## DESCRIPTION
saslauthd is a daemon process that handles plaintext authentication requests on behalf of the SASL library.

The server fulfills two roles: it isolates all code requiring superuser privileges into a single process, and it can be used to provide proxy authentication services to clients that do not understand SASL based authentication.

saslauthd should be started from the system boot scripts when going to multi-user mode. When running against a protected authentication database (e.g. the shadow mechanism), it must be run as the superuser. Otherwise it is recommended to run daemon unprivileged as saslauth:saslauth, requiring the runtime directory to have root:saslauthd owner. You can do so by following these steps in machines using systemd(1) :

- create directory /etc/systemd/system/saslauthd.service.d/

- create file /etc/systemd/system/saslauthd.service.d/user.conf with content

```
[Service]
User=saslauth
Group=saslauth

```

- Reload systemd service file: run “systemctl daemon-reload”

### Options
Options named by lower-case letters configure the server itself. Upper-case options control the behavior of specific authentication mechanisms; their applicability to a particular authentication mechanism is described in the AUTHENTICATION MECHANISMS section.

-a authmech

Use authmech as the authentication mechanism. (See the AUTHENTICATION MECHANISMS section below.) This parameter is mandatory.

-O option

A mechanism specific option (e.g. rimap hostname or config file path)

-H hostname

The remote host to be contacted by the rimap authentication mechanism. (Deprecated, use -O instead)

-m path

Use path as the pathname to the named socket to listen on for connection requests. This must be an absolute pathname, and MUST NOT include the trailing "/mux". Note that the default for this value is "/var/state/saslauthd" (or what was specified at compile time) and that this directory must exist for saslauthd to function.

-n threads

Use threads processes for responding to authentication queries. (default: 5) A value of zero will indicate that saslauthd should fork an individual process for each connection. This can solve leaks that occur in some deployments.

-s size

Use size as the table size of the hash table (in kilobytes)

-t timeout

Use timeout as the expiration time of the authentication cache (in seconds)

-T

Honour time-of-day login restrictions.

-h

Show usage information

-c

Enable caching of authentication credentials

-l

Disable the use of a lock file for controlling access to accept().

-r

Combine the realm with the login (with an '@' sign in between). e.g. login: "foo" realm: "bar" will get passed as login: "foo@bar". Note that the realm will still be passed, which may lead to unexpected behavior for authentication mechanisms that make use of the realm, however for mechanisms which don't, such as getpwent, this is the only way to authenticate domain-specific users sharing the same userid.

-v

Print the version number and available authentication mechanisms on standard error, then exit.

-d

Debugging mode.

### Logging
saslauthd logs its activities via syslogd using the LOG_AUTH facility.

## AUTHENTICATION MECHANISMS
saslauthd supports one or more "authentication mechanisms", dependent upon the facilities provided by the underlying operating system. The mechanism is selected by the -a flag from the following list of choices:

dce

(AIX) Authenticate using the DCE authentication environment.

getpwent

(All platforms) Authenticate using the getpwent() library function. Typically this authenticates against the local password file. See your system's getpwent(3) man page for details.

kerberos4

(All platforms) Authenticate against the local Kerberos 4 realm. (See the NOTES section for caveats about this driver.)

kerberos5

(All platforms) Authenticate against the local Kerberos 5 realm.

pam

(Linux, Solaris) Authenticate using Pluggable Authentication Modules (PAM).

rimap

(All platforms) Forward authentication requests to a remote IMAP server. This driver connects to a remote IMAP server, specified using the -O flag, and attempts to login (via an IMAP ‘LOGIN’ command) using the credentials supplied to the local server. If the remote authentication succeeds the local connection is also considered to be authenticated. The remote connection is closed as soon as the tagged response from the ‘LOGIN’ command is received from the remote server.

The option parameter to the -O flag describes the remote server to forward authentication requests to. hostname can be a hostname (imap.example.com) or a dotted-quad IP address (192.168.0.1). The latter is useful if the remote server is multi-homed and has network interfaces that are unreachable from the local IMAP server. The remote host is contacted on the ‘imap’ service port. A non-default port can be specified by appending a slash and the port name or number to the hostname argument.

The -O flag and argument are mandatory when using the rimap mechanism.

shadow

(AIX, Irix, Linux, Solaris) Authenticate against the local "shadow password file". The exact mechanism is system dependent. saslauthd currently understands the getspnam() and getuserpw() library routines. Some systems honour the -T flag.

sasldb

(All platforms) Authenticate against the SASL authentication database. Note that this is probably not what you want to use, and is even disabled at compile-time by default. If you want to use sasldb with the SASL library, you probably want to use the pwcheck_method of "auxprop" along with the sasldb auxprop plugin instead.

ldap

(All platforms that support OpenLDAP 2.0 or higher) Authenticate against an ldap server. The ldap configuration parameters are read from /etc/sasl2/saslauthd.conf. The location of this file can be changed with the -O parameter. See the LDAP_SASLAUTHD file included with the distribution for the list of available parameters.

sia

(Digital UNIX) Authenticate using the Digital UNIX Security Integration Architecture (a.k.a. "enhanced security").

## NOTES
The kerberos4 authentication driver consumes considerable resources. To perform an authentication it must obtain a ticket granting ticket from the TGT server on every authentication request. The Kerberos library routines that obtain the TGT also create a local ticket file, on the reasonable assumption that you will want to save the TGT for use by other Kerberos applications. These ticket files are unusable by saslauthd , however there is no way not to create them. The overhead of creating and removing these ticket files can cause serious performance degradation on busy servers. (Kerberos was never intended to be used in this manner, anyway.)

## FILES
/var/run/saslauthd/mux

The default communications socket.

/etc/sasl2/saslauthd.conf

The default configuration file for ldap support.

## SEE ALSO
passwd(1), getpwent(3), getspnam(3), getuserpw(3), sasl_checkpass(3) sia_authenticate_user(3),


title: sasldblistusers2(8)

summary: list users in sasldb

text:
# sasldblistusers2(8)

## NAME
sasldblistusers2 - list users in sasldb

## SYNOPSIS
sasldblistusers2 [-f file] [-v]

## DESCRIPTION
sasldblistusers2 is used to list the users in the SASL password database (usually /etc/sasldb2). This will NOT list all the users in /etc/passwd, shadow, PAM, etc. only those created by SASL (via saslpasswd2).

## OPTIONS
-f file

use file for sasldb

-v

Print libsasl2 version number and exit.

## SEE ALSO
saslpasswd2(8)

rfc4422 - Simple Authentication and Security Layer (SASL)


title: saslpasswd2(8)

summary: set a user's sasl password

text:
# saslpasswd2(8)

## NAME
saslpasswd2 - set a user's sasl password

## SYNOPSIS
saslpasswd2 [-p] [-d] [-c] [-n] [-f file] [-u domain] [-a appname] [-v] userid

## DESCRIPTION
saslpasswd2 is used by a server administrator to set a user's sasl password for server programs and SASL mechanisms which use the standard libsasl database of user secrets.

## OPTIONS
-p

Pipe mode - saslpasswd2 will neither prompt for the password nor verify that it was entered correctly. This is the default when standard input is not a terminal.

-c

Creates an entry for the user if the user doesn't already exist. This is mutually exclusive with the -d (delete user) flag.

-d

Deletes the entry for the user. This is mutually exclusive with the -c (create user) flag.

-n

Don't set the plaintext userPassword property for the user. Only mechanism-specific secrets will be set (e.g. OTP, SCRAM, SRP)

-u domain

use domain for user domain (realm).

-f file

use file for sasldb

-a appname

use appname as application name.

-v

Print libsasl2 version number and exit.

## SEE ALSO
sasldblistusers2(8)

rfc4422 - Simple Authentication and Security Layer (SASL)


testsaslauthd

title: testsaslauthd(8)

summary: a test tool for saslauthd

text:
# testsaslauthd(8)

## NAME
testsaslauthd - a test tool for saslauthd

## SYNOPSIS
testsaslauthd -u username -p password

[-r realm] [-s servicename]

[-f socket path] [-R repeatnum]

## DESCRIPTION
This tool is for testing the saslauthd daemon. Do not use it unless you know what you are doing. Read the source code if you need more information.


envdir

package: daemontools-utils

title: envdir(8)

text:
# envdir(8)

## NAME
envdir - runs another program with environment modified according to files in a specified directory.

## SYNOPSIS
envdir d child

## DESCRIPTION
d is a single argument. child consists of one or more arguments.

envdir sets various environment variables as specified by files in the directory named d. It then runs child.

If d contains a file named s whose first line is t, envdir removes an environment variable named s if one exists, and then adds an environment variable named s with value t. The name s must not contain =. Spaces and tabs at the end of t are removed. Nulls in t are changed to newlines in the environment variable.

If the file s is completely empty (0 bytes long), envdir removes an environment variable named s if one exists, without adding a new variable.

## EXIT CODES
envdir exits 111 if it has trouble reading d, if it runs out of memory for environment variables, or if it cannot run child. Otherwise its exit code is the same as that of child.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), softlimit(8), setlock(8)


envuidgid

title: envuidgid(8)

text:
# envuidgid(8)

## NAME
envuidgid - runs another program with environment variables indicating a specified account's uid and gid.

## SYNOPSIS
envuidgid account child

## DESCRIPTION
account is a single argument. child consists of one or more arguments.

envuidgid sets $UID to account's uid and $GID to account's gid. It then runs child.

## EXIT CODES
envuidgid exits 111 if it cannot find a UNIX account named account, if it runs out of memory for environment variables, or if it cannot run child. Otherwise its exit code is the same as that of child.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envdir(8), softlimit(8), setlock(8)


fghack

title: fghack(8)

summary: is an anti-backgrounding tool.

text:
# fghack(8)

## NAME
fghack - is an anti-backgrounding tool.

## SYNOPSIS
fghack child

## DESCRIPTION
fghack runs child with many extra descriptors writing to a pipe. fghack reads and discards any data written to the pipe. After child has exited and the pipe has been closed, fghack exits.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), softlimit(8), setlock(8)


multilog

title: multilog(8)

text:
# multilog(8)

## NAME
multilog - reads a sequence of lines from stdin and appends selected lines to any number of logs.

## SYNOPSIS
multilog script

## DESCRIPTION
script consists of any number of arguments. Each argument specifies one action. The actions are carried out in order for each line of input. Note that actions may contain shell metacharacters that need to be quoted when multilog is run from a shell.

multilog exits 0 when it sees the end of stdin. If stdin has a partial final line then multilog inserts a final newline.

multilog writes a message to stderr and exits 111, without reading any input, if it runs out of memory or if another multilog process is writing to one of the same automatically rotated logs.

If multilog has trouble writing to disk after it starts reading input, it writes a message to stderr, pauses, and tries again, without losing any data. Note that this may block any program feeding input to multilog.

If multilog receives a TERM signal, it will read and process data until the next newline, and then exit, leaving stdin at the first byte of data it has not processed.

## SELECTING LINES
Each line is initially selected. The following actions change this:

-pattern

deselects the line if pattern matches the line.

+pattern

selects the line if pattern matches the line.

F

changes the pattern match mode to use fnmatch for all subsequent patterns.

S

changes the pattern match mode back to use simple patterns (the default).

### SIMPLE PATTERNS
pattern is a string of stars and non-stars. It matches any concatenation of strings matched by all the stars and non-stars in the same order. A non-star matches itself. A star before the end of pattern matches any string that does not include the next character in pattern. A star at the end of pattern matches any string.

For example, the action

+hello

selects hello. It does not select hello world.

The action

-named[*]: Cleaned cache *

deselects named[135]: Cleaned cache of 3121 RRs. The first star matches any string that does not include a right bracket.

The action

-*

deselects every line.

To save memory, multilog actually checks pattern against only the first 1000 characters of each line.

### FNMATCH PATTERNS
When fnmatch mode is selected, multilog uses the system's fnmatch function to match pattern. This mode is less efficient than the simple patterns, but more flexable in the types of patterns it allows.

In particular,

?

(not between brackets) matches any single character,

*

(not between brackets) matches any string, including the empty string,

[...]

matches a single character, and

\?, \*, and \[

match ?, *, [ exactly, respectively.

The expression [...] matches any single character enclosed by the brackets. If the first character within the brackets is !, the expression matches any character except those enclosed by the brackets. Two characters within the brackets separated by - denote a range. [A-F] is equivalent to [ABCDEF]. The characters ?, *, and [ lose their special meaning within the brackets.

See the fnmatch(3) or glob(7) man pages for more details.

## ALERTS
The action

e

prints (the first 200 bytes of) each selected line to stderr.

## STATUS FILES
The action

=file

replaces the contents of file with (the first 1000 bytes of) each selected line, padded with newlines to 1001 bytes. There is no protection of file against power outages. For example, the sequence of actions

-*

+STAT*

=log/status

maintains log/status as a copy of the most recent line starting with STAT.

## TIMESTAMPING
The action

t

inserts an @, a precise timestamp, and a space in front of each line, using the same format as tai64n(8).

T

inserts an accustamp-style timestamp and a space in front of each line, formatted as S.M where S is the number of seconds since the UNIX epoch (midnight January 1 1970-01-01 UTC) and M is the number of microseconds.

These are required to be the first action.

Patterns apply to the line after the timestamp is inserted. For example, if

multilog t '-*' '+* fatal: *' ./main

reads the line

fatal: out of memory

then it will log a line such as

@400000003b4a39c23294b13c fatal: out of memory

with the first * matching the timestamp.

You can use tai64nlocal(8) to convert these timestamps to human-readable form.

## AUTOMATICALLY ROTATED LOGS
If dir starts with a dot or slash then the action

dir

appends each selected line to a log named dir. If dir does not exist, multilog creates it.

Do not attempt to write to one log from two simultaneous multilog processes, or two actions in one process.

The log format is as follows. dir is a directory containing some number of old log files, a log file named current, and other files for multilog to keep track of its actions. Each old log file has a name beginning with @, continuing with a precise timestamp showing when the file was finished, and ending with one of the following codes:

.s

This file is completely processed and safely written to disk. This code may be changed as described below.

.u

This file was being created at the moment of an outage. It may have been truncated and has not been processed.

Beware that NFS, async filesystems, and softupdates filesystems may discard files that were not safely written to disk before an outage.

While multilog is running, current has mode 644. If multilog sees the end of stdin, it writes current safely to disk, and sets the mode of current to 744. When it restarts, it sets the mode of current back to 644 and continues writing new lines.

When multilog decides that current is big enough, it writes current safely to disk, sets the mode of current to 744, and renames current as an old log file.

ssize

sets the maximum file size for subsequent dir actions. multilog will decide that current is big enough if current has size bytes. (multilog will also decide that current is big enough if it sees a newline within 2000 bytes of the maximum file size; it tries to finish log files at line boundaries.) size must be between 4096 and 2147483647. The default maximum file size is 99999. In versions 0.75 and above: If multilog receives an ALRM signal, it immediately decides that current is big enough, if current is nonempty.

nnum

sets the number of log files for subsequent dir actions. After renaming current, if multilog sees num or more old log files, it removes the old log file with the smallest timestamp. num must be at least 2. The default number of log files is 10.

!processor

sets a processor for subsequent dir actions. multilog will feed current through processor and save the output as an old log file instead of current. multilog will also save any output that processor writes to descriptor 5, and make that output readable on descriptor 4 when it runs processor on the next log file. For reliability, processor must exit nonzero if it has any trouble creating its output; multilog will then run it again. Note that running processor may block any program feeding input to multilog.

wcode

Changes the "safely written" code from .s as described above to .code for subsequent dir actions. This is useful when using a processor that compresses or otherwise translates the completed log file into a different file format.

## SEE ALSO
fnmatch(3), glob(7), supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), softlimit(8), setlock(8)


pgrphack

title: pgrphack(8)

text:
# pgrphack(8)

## NAME
pgrphack - runs a program in a separate process group.

## SYNOPSIS
pgrphack child

## DESCRIPTION
pgrphack runs child in a new process group.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), softlimit(8), setlock(8)


readproctitle

title: readproctitle(8)

text:
# readproctitle(8)

## NAME
readproctitle - maintains an automatically rotated log in memory for inspection by ps(1).

## SYNOPSIS
readproctitle L D

## DESCRIPTION
L consists of any number of arguments. D is one argument consisting of at least five dots.

readproctitle reads data into the end of D, shifting D to the left to make room. This means that the most recent data is visible to process-listing tools such as ps(1). readproctitle always leaves three dots at the left of D.

For example, if

readproctitle io errors: ....................

reads the data

fatal error xyz

warning abc

then its command-line arguments change to

readproctitle io errors: ... xyz!warning abc!

with a newline character in place of each !. Process-listing tools typically show the newline character as ? or \n.

readproctitle exits when it reaches the end of input.

Beware that most implementations of ps(1) have small argument-length limits. These limits apply to the total length of readproctitle L D. I have not seen a system with a limit below 512 bytes.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), softlimit(8), setlock(8), ps(1)


setlock

title: setlock(8)

text:
# setlock(8)

## NAME
setlock - runs another program with a file locked.

## SYNOPSIS
setlock [ -nNxX ] fn child

## DESCRIPTION
fn is a single argument. child consists of one or more arguments.

setlock opens fn for writing (creating it if it does not exist), obtains an exclusive lock on it, and runs child.

Normally the lock disappears when child exits.

Here's the complete story: child is given a descriptor for a locked ofile pointing to the disk file named fn. The lock disappears when this ofile is

o

closed by all the processes that have descriptors for it or

o

explicitly unlocked.

## OPTIONS
-n

No delay. If fn is locked by another process, setlock gives up.

-N

(Default.) Delay. If fn is locked by another process, setlock waits until it can obtain a new lock.

-x

If fn cannot be opened (or created) or locked, setlock exits zero.

-X

(Default.) If fn cannot be opened (or created) or locked, setlock prints an error message and exits nonzero.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), softlimit(8)


setuidgid

title: setuidgid(8)

text:
# setuidgid(8)

## NAME
setuidgid - runs another program under a specified account's uid and gid.

## SYNOPSIS
setuidgid [ -s ] account child

## DESCRIPTION
account is a single argument. child consists of one or more arguments.

setuidgid sets its uid and gid to account's uid and gid, removing all supplementary groups. It then runs child.

setuidgid cannot be run by anyone other than root.

## EXIT CODES
setuidgid exits 111 if it cannot find a UNIX account named account, if it cannot setgid, if it cannot setuid, or if it cannot run child. Otherwise its exit code is the same as that of child.

## OPTIONS
-s

Set account's supplementary gids.

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), envuidgid(8), envdir(8), softlimit(8), setlock(8)


softlimit

title: softlimit(8)

text:
# softlimit(8)

## NAME
softlimit - runs another program with new resource limits.

## SYNOPSIS
softlimit [ opts ] child

## DESCRIPTION
opts is a series of getopt-style options. child consists of one or more arguments.

softlimit sets soft resource limits as specified by opts. It then runs child.

## OPTIONS
In each of the following opts, n may be =, indicating that the soft limit should be set equal to the hard limit.

opts controlling memory use:

-m n

Same as -d n -s n -l n -a n.

-d n

Limit the data segment per process to n bytes.

-s n

Limit the stack segment per process to n bytes.

-l n

Limit the locked physical pages per process to n bytes. This option has no effect on some operating systems.

-a n

Limit the total of all segments per process to n bytes. This option has no effect on some operating systems.

-o n

Limit the number of open file descriptors per process to n. This option has no effect on some operating systems.

-p n

Limit the number of processes per uid to n.

opts controlling file sizes:

-f n

Limit output file sizes to n bytes.

-c n

Limit core file sizes to n bytes.

Efficiency opts:

-r n

Limit the resident set size to n bytes. This limit is not enforced unless physical memory is full.

-t n

Limit the CPU time to n seconds. This limit is not enforced except that the process receives a SIGXCPU signal after n seconds.

## ENVIRONMENT
SOFTLIMIT_ALLBYTES

Same as -a

SOFTLIMIT_COREBYTES

Same as -c

SOFTLIMIT_DATABYTES

Same as -d

SOFTLIMIT_FILEBYTES

Same as -f

SOFTLIMIT_LOCKEDBYTES

Same as -l

SOFTLIMIT_MEMBYTES

Same as -m

SOFTLIMIT_OPENFILES

Same as -o

SOFTLIMIT_PROCS

Same as -p

SOFTLIMIT_RSSBYTES

Same as -r

SOFTLIMIT_STACKBYTES

Same as -s

SOFTLIMIT_CPUSECS

Same as -t

## SEE ALSO
supervise(8), svc(8), svok(8), svstat(8), svscanboot(8), svscan(8), readproctitle(8), fghack(8), pgrphack(8), multilog(8), tai64n(8), tai64nlocal(8), setuidgid(8), envuidgid(8), envdir(8), setlock(8)