helper-mux

title: helper-mux(8)

text:
# helper-mux(8)

## NAME
helper-mux - Concurrency protocol multiplexer for Squid helpers

## SYNOPSIS
helper-mux helper-path [helper-options ...]

## DESCRIPTION
helper-mux purpose is to relieve some of the burden squid has when dealing with slow helpers. It does so by acting as a middleman between squid and the actual helpers, talking to squid via the multiplexed variant of the helper protocol and to the helpers via the non-multiplexed variant.

Helpers are started on demand, and in theory the muxer can handle up to 1k helpers per instance. It is up to squid to decide how many helpers to start.

The helper can be controlled using various signals: - SIGHUP: dump the state of all helpers to STDERR

## OPTIONS
helper-path

Path to the helper being multiplexed.

helper-options

Command line options for the helper being multiplexed.

## KNOWN ISSUES
helper-mux knows nothing about the actual messages being passed around, and as such cannot yet compensate for broken helpers.

It is not yet able to manage dying helpers.

## COPYRIGHT

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
   Copyright (C) Francesco Chemolli <kinkie@squid-cache.org>
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2 of the License, or
   (at your option) any later version.
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111, USA.
```


package: squid-helpers

title: log_db_daemon(8)

summary: Database logging daemon for Squid

text:
# log_db_daemon(8)

## NAME
log_db_daemon - Database logging daemon for Squid

Version 0.5.

## SYNOPSIS
log_db_daemon DSN [options]

## DESCRIPTION
This program writes Squid access.log entries to a database. Presently only accepts the squid native log format.

The script has been developed and tested in the following environment:

squid-2.7 Squid-3.2

mysql 5.0.26 and 5.1

perl 5.8.8

OpenSUSE 10.2

## OPTIONS
DSN

Database DSN encoded as a path. This is sent as the access_log file path. Sample configuration:

access_log daemon:/host/database/table/username/password squid

```
  to leave a parameter unspecified use a double slash:
  access_log daemon://database/table/username/password squid

```

Default "DBI:mysql:database=squid"

--debug

Write debug info to stderr.

## CONFIGURATION

### Squid configuration
access_log directive

The path to the access log file is used to provide the database connection parameters.

```
  access_log daemon:/mysql_host:port/database/table/username/password squid
```

The 'daemon' prefix is mandatory and tells squid that the logfile_daemon helper is to be used instead of the normal file logging.

The last parameter tells squid which log format to use when writing lines to the log daemon. Presently squid format is supported.

mysql_host:port

Host where the mysql server is running. If left empty, 'localhost' is assumed.

database

Name of the database to connect to. If left empty, 'squid_log' is assumed.

table

Name of the database table where log lines are stored. If left empty, 'access_log' is assumed.

username

Username to use when connecting to the database. If left empty, 'squid' is assumed.

password

Password to use when connecting to the database. If left empty, no password is used.

To leave all fields to their default values, you can use a single slash:

```
  access_log daemon:/ squid
```

To specify only the database password, which by default is empty, you must leave unspecified all the other parameters by using null strings:

```
  access_log daemon://///password squid
```

logfile_daemon directive

This is the current way of telling squid where the logfile daemon resides.

```
  logfile_daemon /path/to/squid/libexec/logfile-daemon_mysql.pl
```

The script must be copied to the location specified in the directive.

### Database configuration
Let's call the database 'squid_log' and the log table 'access_log'. The username and password for the db connection will be both 'squid'.

Database

Create the database:

```
  CREATE DATABASE squid_log;
```

User

Create the user:

```
  GRANT INSERT,SELECT,CREATE ON squid_log.* TO 'squid'@'localhost' IDENTIFIED BY 'squid';
  FLUSH PRIVILEGES;
```

Note that only CREATE, INSERT and SELECT privileges are granted to the 'squid' user. This ensures that the logfile daemon script cannot change or modify the log entries.

Table

The Daemon will attempt to initialize this table if none exists when it starts.

The table created should look like:

```
  CREATE TABLE access_log (
    id                   INTEGER NOT NULL AUTO_INCREMENT PRIMARY KEY,
    time_since_epoch     DECIMAL(15,3),
    time_response        INTEGER,
    ip_client            CHAR(15),
    ip_server            CHAR(15),
    http_status_code     VARCHAR(10),
    http_reply_size      INTEGER,
    http_method          VARCHAR(20),
    http_url             TEXT,
    http_username        VARCHAR(20),
    http_mime_type       VARCHAR(50),
    squid_hier_status    VARCHAR(20),
    squid_request_status VARCHAR(20)
  );
```

## DATA EXTRACTION

### Sample queries.
Clients accessing the cache

```
  SELECT DISTINCT ip_client FROM access_log;

```

Number of request per day

```
  SELECT
    DATE(FROM_UNIXTIME(time_since_epoch)) AS date_day,
    COUNT(*) AS num_of_requests
  FROM access_log
  GROUP BY 1
  ORDER BY 1;

```

Request status count

To obtain the raw count of each request status:

```
  SELECT squid_request_status, COUNT(*) AS n
  FROM access_log
  GROUP BY squid_request_status
  ORDER BY 2 DESC;

```

To calculate the percentage of each request status:

```
  SELECT
    squid_request_status,
    (COUNT(*)/(SELECT COUNT(*) FROM access_log)*100) AS percentage
  FROM access_log
  GROUP BY squid_request_status
  ORDER BY 2 DESC;

```

To distinguish only between HITs and MISSes:

```
  SELECT
    'hits',
    (SELECT COUNT(*)
    FROM access_log
    WHERE squid_request_status LIKE '%HIT%')
    /
    (SELECT COUNT(*) FROM access_log)*100
    AS percentage
  UNION
  SELECT
    'misses',
    (SELECT COUNT(*)
    FROM access_log
    WHERE squid_request_status LIKE '%MISS%')
    /
    (SELECT COUNT(*) FROM access_log)*100
    AS percentage;

```

Response time ranges

```
  SELECT
    '0..500',
    COUNT(*)/(SELECT COUNT(*) FROM access_log)*100 AS percentage
  FROM access_log
  WHERE time_response >= 0 AND time_response < 500
  UNION
  SELECT
    '500..1000',
    COUNT(*)/(SELECT COUNT(*) FROM access_log)*100 AS percentage
  FROM access_log
  WHERE time_response >= 500 AND time_response < 1000
  UNION
  SELECT
    '1000..2000',
    COUNT(*)/(SELECT COUNT(*) FROM access_log)*100 AS percentage
  FROM access_log
  WHERE time_response >= 1000 AND time_response < 2000
  UNION
  SELECT
    '>= 2000',
    COUNT(*)/(SELECT COUNT(*) FROM access_log)*100 AS percentage
  FROM access_log
  WHERE time_response >= 2000;

```

Traffic by mime type

```
  SELECT
    http_mime_type,
    SUM(http_reply_size) as total_bytes
  FROM access_log
  GROUP BY http_mime_type
  ORDER BY 2 DESC;

```

Traffic by client

```
  SELECT
    ip_client,
    SUM(http_reply_size) AS total_bytes
  FROM access_log
  GROUP BY 1
  ORDER BY 2 DESC;

```

## KNOWN ISSUES

### Speed issues
The MyISAM storage engine is known to be faster than the InnoDB one, so although it doesn't support transactions and referential integrity, it might be more appropriate in this scenario. You might want to append "ENGINE=MYISAM" at the end of the table creation code in the above SQL script.

Indexes should be created according to the queries that are more frequently run. The DDL script only creates an implicit index for the primary key column.

### Table cleanup
This script currently implements only the "L" (i.e. "append a line to the log") command, therefore the log lines are never purged from the table. This approach has an obvious scalability problem.

One solution would be to implement e.g. the "rotate log" command in a way that would calculate some summary values, put them in a "summary table" and then delete the lines used to calculate those values.

Similar cleanup code could be implemented in an external script and run periodically independently from squid log commands.

### Testing
This script has only been tested in low-volume scenarios (single client, less than 10 req/s). Tests in high volume environments could reveal performance bottlenecks and bugs.

## AUTHOR
This program was written by Marcello Romani <marcello.romani@libero.it> , Amos Jeffries <amosjeffries@squid-cache.org>

## COPYRIGHT

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
```

Copyright (C) 2008 by Marcello Romani

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.

## QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid (8), GPL (7),

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/

branch: sisyphus


title: negotiate_kerberos_auth(8)

text:
# negotiate_kerberos_auth(8)

## NAME
negotiate_kerberos_auth - Squid kerberos based authentication helper

Version 3.0.4sq

## SYNOPSIS
negotiate_kerberos_auth [-h] [-d] [-i] [-r] [-s Service-Principal-Name] [-k Keytab-Name] [-c Replay-Cache-Directory] [-t Replay-Cache-Type]

## DESCRIPTION
negotiate_kerberos_auth is an installed binary and allows Squid to authenticate users via the Negotiate protocol and Kerberos.

## OPTIONS
-h

Display the binary help and command line syntax info using stderr.

-d

Write debug messages to stderr.

-i

Write informational messages to stderr.

-r

Remove realm from username before returning the username to squid.

-s Service-Principal-name

Provide Service Principal Name.

-k Keytab-Name

Provide Kerberos Keytab Name (Default: /etc/krb5.keytab)

-c Replay-Cache-Directory

Provide Replay Cache Directory (Default: /var/tmp)

-t Replay-Cache-Type

Provide Replay Cache Type (Default: dfl)

## CONFIGURATION
This helper is intended to be used as an authentication helper in squid.conf.

```
auth_param negotiate program /path/to/negotiate_kerberos_auth

auth_param negotiate children 10

auth_param negotiate keep_alive on
```

NOTE: The following squid startup file modification may be required:

Add the following lines to the squid startup script to point squid to a keytab file which contains the HTTP/fqdn service principal for the default Kerberos domain. The keytab name can also be provided by the -k <keytab name> option. The fqdn must be the proxy name set in IE

or firefox. You can not use an IP address.

KRB5_KTNAME=/etc/squid/HTTP.keytab export KRB5_KTNAME

If you use a different Kerberos domain than the machine itself is in you can point squid to the separate Kerberos config file by setting the following environment variable in the startup script.

KRB5_CONFIG=/etc/krb5-squid.conf export KRB5_CONFIG

Kerberos can keep a replay cache to detect the reuse of Kerberos tickets (usually only possible in a 5 minute window) . If squid is under high load with Negotiate(Kerberos) proxy authentication requests the replay cache checks can create high CPU load. If the environment does not require high security the replay cache check can be disabled for MIT based Kerberos implementations by adding the below to the startup script or use the -t none option.

KRB5RCACHETYPE=none export KRB5RCACHETYPE

If negotiate_kerberos_auth doesn't determine for some reason the right service principal you can provide it with -s HTTP/fqdn.

If you serve multiple Kerberos realms add a HTTP/fqdn@REALM service principal per realm to the HTTP.keytab file and use the -s GSS_C_NO_NAME option with negotiate_kerberos_auth.

## AUTHOR
This program was written by Markus Moeller <markus_moeller@compuserve.com>

This manual was written by Markus Moeller <markus_moeller@compuserve.com>

## COPYRIGHT

* Copyright (C) 1996-2014 The Squid Software Foundation and contributors

*

* Squid software is distributed under GPLv2+ license and includes

* contributions from numerous individuals and organizations.

* Please see the COPYING and CONTRIBUTORS files for details.

This program and documentation is copyright to the authors named above.

Distributed under the GNU General Public License (GNU GPL) version 2 or later (GPLv2+).

## QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using http://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid(8) ext_kerberos_ldap_group_acl(8)

RFC4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows,

RFC2478 - The Simple and Protected GSS-API Negotiation Mechanism,

RFC1964 - The Kerberos Version 5 GSS-API Mechanism,

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/ https://wiki.squid-cache.org/ConfigExamples/Authenticate/Kerberos


title: security_fake_certverify(8)

summary: A fake cert validation helper for Squid

text:
# security_fake_certverify(8)

## NAME
security_fake_certverify - A fake cert validation helper for Squid

## SYNOPSIS
security_fake_certverify [-d | --debug] [-h | --help]

## DESCRIPTION
Retrieves the SSL certificate error list from Squid and echo back without any change.

## OPTIONS
-h | --help

brief help message

-d | --debug

enable debug messages to stderr

## AUTHOR
This program and documentation was written by Christos Tsantilas <chtsanti@users.sourceforge.net>

## COPYRIGHT

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
```

(C) 2012 The Measurement Factory, Author: Tsantilas Christos

This program is free software. You may redistribute copies of it under the terms of the GNU General Public License version 2, or (at your opinion) any later version.

## QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid (8), GPL (7),

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/


title: security_file_certgen(8)

summary: SSL certificate generator for Squid.

text:
# security_file_certgen(8)

## NAME
security_file_certgen - SSL certificate generator for Squid.

Version 1.1

## SYNOPSIS
security_file_certgen [-cdhv] [-s directory -M size ] [-b fs_block_size ]

## DESCRIPTION
security_file_certgen is an installed binary.

Because the generation and signing of SSL certificates takes time Squid can use this helper as an external process to handle the work. Communication occurs via TCP sockets bound to the loopback interface. This helper can use a disk cache of certificates to improve response times on repeated requests. It can also operate without a cache, generating new certificates on every request.

## OPTIONS
-b fs_block_size

File system block size in bytes. Needed for processing natural size of certificate on disk. Default value is 2048 bytes. The following suffixes are accepted: B, KB, MB, GB. When no suffix is set, B is assumed.

-c

Initialize the SSL storage database and exit. Requires the -s and -M options to determine the storage location and size being created.

-d

Write debug info to stderr.

-h

Display the binary help and command line syntax info using stderr.

-s directory

Directory path of SSL storage database. Requires the -M option.

-M size

Maximum size of SSL certificate disk storage. Same suffixes supported by the -b option can be used.

-v

Display the binary version details using stderr.

## KNOWN ISSUES
SSL errors after changing the CA

Certificates are stored in this database in signed form. After any change to the signing CA in squid.conf be sure to erase and reinitialize the certificate database.

Certificate chaining

The versions 1.0 to 1.1 of this helper will not add chained intermediate CA certificates. The client must have a full chain of trust from the root CA all the way down to the end certificate generated by this program. Signing with an intermediate CA needs to install both the root and the intermediate public CA on the clients.

## CONFIGURATION
Before this helper can be used with disk storage, the storage area for new certificates must be initialized manually. This is done from the command line using the -c parameter.

For example:

/usr/lib/squid/security_file_certgen -c -s /var/spool/squid/ssl_db -M 4MB

Certificates are stored in this database in signed form. After any change to the signing CA in squid.conf be sure to erase and re-initialize the certificate database.

For simple configuration the helper defaults can be used. Only HTTP listening port options are required to enable generation and set the signing CA certificate.

For example:

http_port 3128 ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/example.com.pem

For more customized configuration, the helper certificate storage directory location and size can be altered with the sslcrtd_program configuration directive. The number of helper processes running can be configured with the and ssl_crtd_children configuration directive.

For example:

sslcrtd_program /usr/lib/squid/security_file_certgen -s /var/spool/squid/ssl_db -M 4MB

sslcrtd_children 5

To operate without disk storage, the helper should be configured explicitly without the -s and -M parameters.

For example:

sslcrtd_program /usr/lib/squid/security_file_certgen

## AUTHOR
This program was written by Christos Tsantilas <christos@chtsanti.net>

This manual was written by Christos Tsantilas <christos@chtsanti.net> and Amos Jeffries <amosjeffries@squid-cache.org>

## COPYRIGHT

* Copyright (C) 1996-2026 The Squid Software Foundation and contributors

*

* Squid software is distributed under GPLv2+ license and includes

* contributions from numerous individuals and organizations.

* Please see the COPYING and CONTRIBUTORS files for details.

## QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid(8), GPL(7),

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/


title: storeid_file_rewrite(8)

summary: File based Store\-ID helper for Squid

text:
# storeid_file_rewrite(8)

## NAME

```
 storeid_file_rewrite - File based Store-ID helper for Squid
```

## SYNOPSIS

```
 storeid_file_rewrite filepath
```

## DESCRIPTION
This program acts as a store_id helper program, rewriting URLs passed by Squid into storage-ids that can be used to achieve better caching for websites that use different URLs for the same content.

It takes a text file with two tab separated columns. Column 1: Regular expression to match against the URL Column 2: Rewrite rule to generate a Store-ID Eg: ^http:\/\/[^\.]+\.dl\.sourceforge\.net\/(.*) http://dl.sourceforge.net.squid.internal/$1

Rewrite rules are matched in the same order as they appear in the rules file. So for best performance, sort it in order of frequency of occurrence.

This program will automatically detect the existence of a concurrency channel-ID and adjust appropriately. It may be used with any value 0 or above for the store_id_children concurrency= parameter.

## OPTIONS
The only command line parameter this helper takes is the regex rules file name.

## AUTHOR
This program and documentation was written by Alan Mizrahi <alan@mizrahi.com.ve>

Based on prior work by Eliezer Croitoru <eliezer@ngtech.co.il>

## COPYRIGHT

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
 Copyright (C) 2013 Alan Mizrahi <alan@mizrahi.com.ve>
 Based on code from Eliezer Croitoru <eliezer@ngtech.co.il>
 This program is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
 the Free Software Foundation; either version 2 of the License, or
 (at your option) any later version.
 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with this program; if not, write to the Free Software
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
```

## QUESTIONS
Questions on the usage of this program can be sent to the Squid Users mailing list <squid-users@lists.squid-cache.org>

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid (8), GPL (7),

The Squid wiki https://wiki.squid-cache.org/Features/StoreID

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/


title: url_lfs_rewrite(8)

summary: a URL\-rewriter based on local file existence

text:
# url_lfs_rewrite(8)

## NAME

```
 url_lfs_rewrite - a URL-rewriter based on local file existence
```

## SYNOPSIS

```
 url_lfs_rewrite [--debug] --local-dir=/var/www/ [options]
```

## DESCRIPTION
Direct all request to files who are in a local directory to a local web server hosting this directory.

This program uses Squid concurrency support.

## OPTIONS
--debug

Write debug info to stderr.

--local-dir

Directory path under which the scripts searches for files.

--to-scheme

Scheme to use for the redirected URL.

```
 Default: http

```

--to-host

Domain name to use for the redirected URL.

```
 Default: localhost

```

--to-path

URL path to add as prefix for the redirected URL path. If set it must end with a '/'.

```
 Default: use the original URL path.

```

## KNOWN ISSUES
* The --local-dir parameter must end with a '/'. Otherwise no

file paths will be found.

* URL with no filename in the path can match directories on the local

filesystem and be wrongly redirected to the local web server.

* Any scheme name accepted by the Perl URL library can be used

as the --to-scheme parameter. However only schemes supported by

Squid will work.

* URL containing query-string are not handled well and will not

be rewritten even if the base script or file exists on the local

system.

## CONFIGURATION

```
  url_rewrite_program /path/to/url_lfs_rewrite --local-dir=\var\www\localhost
  url_rewrite_children 20 startup=1 idle=1 concurrency=25
  url_rewrite_access deny CONNECT
  url_rewrite_access deny to_localhost
```

This helper can redirect to any web server but only does so if there is a file matching the URL path segment in the local filesystem. Normal configuration requires a web server running on localhost serving up files from a local disk (eg. \var\www\localhost). Configuration of that web server is not covered here.

## AUTHOR
This program and documentation was written by Amos Jeffries <squid3@treenet.co.nz>

Based on prior work in rredir.pl by Peter Eisenhauer <pe@pipetronix.de>. First Version: 26. May 1997

## COPYRIGHT

```
 * Copyright (C) 1996-2026 The Squid Software Foundation and contributors
 *
 * Squid software is distributed under GPLv2+ license and includes
 * contributions from numerous individuals and organizations.
 * Please see the COPYING and CONTRIBUTORS files for details.
```

## REPORTING BUGS
Bug reports need to be made in English. See https://wiki.squid-cache.org/SquidFaq/BugReporting for details of what you need to include with your bug report.

Report bugs or bug fixes using https://bugs.squid-cache.org/

Report serious security bugs to Squid Bugs <squid-bugs@lists.squid-cache.org>

Report ideas for new improvements to the Squid Developers mailing list <squid-dev@lists.squid-cache.org>

## SEE ALSO
squid (8), GPL (7),

The Squid FAQ wiki https://wiki.squid-cache.org/SquidFaq

The Squid Configuration Manual http://www.squid-cache.org/Doc/config/


ibsrpdm

title: ibsrpdm(8)

text:
# ibsrpdm(8)

## NAME
ibsrpdm - Discover SRP targets on an InfiniBand Fabric

## SYNOPSIS
ibsrpdm [OPTIONS]

## DESCRIPTION
List InfiniBand SCSI RDMA Protocol (SRP) targets on an IB fabric.

## OPTIONS
-c

Generate output suitable for piping directly to a /sys/class/infiniband_srp/srp-<device>-<port>/add_target file

-d DEVICE

Use device file DEVICE (default /dev/infiniband/umad0)

-k P_KEY

Use InfiniBand partition key P_KEY (default 0xffff)

-v

Print more verbose output

## SEE ALSO
srp_daemon(1)

## AUTHORS
Roland Dreier

<roland@kernel.org>


title: srp_daemon(8)

text:
# srp_daemon(8)

## NAME
srp_daemon - Discovers SRP targets in an InfiniBand Fabric

## SYNOPSIS
srp_daemon [-vVcaeon] [-d umad-device | -i infiniband-device [-p port-num] | -j dev:port] [-t timeout(ms)] [-r retries] [-R rescan-time] [-f rules-file]

## DESCRIPTION
Discovers and connects to InfiniBand SCSI RDMA Protocol (SRP) targets in an IB fabric.

Each srp_daemon instance operates on one local port. Upon boot it performs a full rescan of the fabric and then waits for an srp_daemon event. An srp_daemon event can be a join of a new machine to the fabric, a change in the capabilities of a machine, an SA change, or an expiration of a predefined timeout.

When a new machine joins the fabric, srp_daemon checks if it is an SRP target. When there is a change of capabilities, srp_daemon checks if the machine has turned into an SRP target. When there is an SA change or a timeout expiration, srp_daemon performs a full rescan of the fabric.

For each target srp_daemon finds, it checks if it should connect to this target according to its rules (the default rules file is /etc/srp_daemon.conf) and if it is already connected to the local port. If it should connect to this target and if it is not connected yet, srp_daemon can either print the target details or connect to it.

## OPTIONS
-v

Print more verbose output

-V

Print even more verbose output (debug mode)

-i infiniband-device

Work on infiniband-device. This option should not be used with -d nor with -j.

-p port-num

Work on port port-num (default 1). This option must be used with -i and should not be used with -d nor with -j.

-j dev:port

Work on port number port of InfiniBand device dev. This option should not be used with -d, -i nor with -p.

-d umad-device

Use device file umad-device (default /dev/infiniband/umad0) This option should not be used with -i, -p nor with -j.

-c

Generate output suitable for piping directly to a /sys/class/infiniband_srp/srp-<device>-<port>/add_target file.

-a

Prints all the targets in the fabric, not only targets that are not connected through the local port. This is the same behavior as that of ibsrpdm.

-e

Execute the connection command, i.e., make the connection to the target.

-o

Perform only one rescan and exit just like ibsrpdm.

-R rescan-time

Force a complete rescan every rescan-time seconds. If -R is not specified, no timeout rescans will be performed.

-T retry-timeout

Retries to connect to existing target after retry-timeout seconds. If -R is not specified, uses 5 Seconds timeout. if retry-timeout is 0, will not try to reconnect. The reason srp_daemon retries to connect to the target is because there may be a rare scnerio in which srp_daemon will try to connect to add a target when the target is about to be removed, but is not removed yet.

-f rules-file

Decide to which targets to connect according to the rules in rules-file. If -f is not specified, uses the default rules file /etc/srp_daemon.conf. Each line in the rules-file is a rule which can be either an allow connection or a disallow connection according to the first character in the line (a or d accordingly). The rest of the line is values for id_ext, ioc_guid, dgid, service_id. Please take a look at the example section for an example of the file. srp_daemon decide whether to allow or disallow each target according to first rule that match the target. If no rule matches the target, the target is allowed and will be connected. In an allow rule it is possible to set attributes for the connection to the target. Supported attributes are max_cmd_per_lun and max_sect.

-t timeout

Use timeout of timeout msec for MAD responses (default: 5 sec).

-r retries

Perform retries retries on each send to MAD (default: 3 retries).

-n

New format - use also initiator_ext in the connection command.

--systemd

Enable systemd integration.

## FILES
/etc/srp_daemon.conf - Default rules configuration file that indicates to which targets to connect. Can be overridden using the -f rules-file option. Each line in this file is a rule which can be either an allow connection or a disallow connection according to the first character in the line (a or d accordingly). The rest of the line is values for id_ext, ioc_guid, dgid, service_id. Please take a look at the example section for an example of the file. srp_daemon decide whether to allow or disallow each target according to first rule that match the target. If no rule matches the target, the target is allowed and will be connected. In an allow rule it is possible to set attributes for the connection to the target. Supported attributes are max_cmd_per_lun and max_sect.

## EXAMPLES
srp_daemon -e -i mthca0 -p 1 -R 60 (Connects to the targets accessible through port 1 of mthca0. Performs a complete rescan every minute)

srp_daemon -o -c -a (Prints the connection commands for the targets in the fabric and exits - similar to ibsrpdm)

srp_daemon -e -f rules.txt (Connects to the targets allowed in the rules file rules.txt)

```
An example for a rules configuration file (such as /etc/srp_daemon.conf)
------------------------------------------------------------------------
# Rules file example
# This is a comment
# disallow the following dgid
d       dgid=fe800000000000000002c90200402bd5
# allow target with the following ioc_guid
a       ioc_guid=00a0b80200402bd7
# allow target with the following id_ext and ioc_guid. And setting max_cmd_per_lun to 31.
a       id_ext=200500A0B81146A1,ioc_guid=00a0b80200402bef,max_cmd_per_lun=31
# disallow all the rest
d
```

## SEE ALSO
ibsrpdm(8)

## AUTHORS
Roland Dreier

<rolandd@cisco.com>

Ishai Rabinovitz

<ishai@mellanox.co.il>


sscg

package: sscg

title: sscg(8)

summary: Tool for generating x.509 certificates

text:
# sscg(8)

## NAME
sscg - Tool for generating x.509 certificates

## SYNOPSIS
sscg [OPTION...]

## DESCRIPTION
-V, --version

Display the version number and exit.

-f, --force

Overwrite any pre-existing files in the requested locations. DANGER: You probably don't want to use this!

### Help options:
-?, --help

Show this help message

--usage

Display brief usage message

Verbosity options

-q, --quiet

Display no output unless there is an error.

-v, --verbose

Display progress messages.

-d, --debug

Enable logging of debug messages. Implies verbose. Warning! This will print private key information to the screen!

Certificate Subject options

--lifetime=1-3650

Certificate lifetime (days). (default: 398)

--country=US, CZ, etc.

Certificate DN: Country (C). (default: "US")

--state=Massachusetts, British Columbia, etc.

Certificate DN: State or Province (ST).

--locality=Westford, Paris, etc.

Certificate DN: Locality (L).

--organization=My Company

Certificate DN: Organization (O). (default: "Unspecified")

--organizational-unit=Engineering, etc.

Certificate DN: Organizational Unit (OU).

--email=myname@example.com

Certificate DN: Email Address (Email).

--hostname=server.example.com

The valid hostname of the certificate. Must be an FQDN. (default: current system FQDN)

--subject-alt-name alt.example.com

Optional additional valid hostnames for the certificate. In addition to hostnames, this option also accepts explicit values supported by RFC 5280 such as IP:xxx.xxx.xxx.xxx May be specified multiple times.

Certificate Key Cryptography Options

--key-type={rsa,ecdsa,mldsa}

Type of key to use for the certificate private keys. (default: rsa)

--key-strength=2048 or larger

Strength of the certificate private keys in bits. This argument is only valid if --key-type is set to rsa. (default: 2048)

--ec-curve={secp224r1,secp256r1,secp384r1,secp521r1}

EC curve to use for the certificate private keys. This argument is only valid if --key-type is set to ecdsa.

--mldsa-nist-level={2,3,5}

NIST level to use for the ML-DSA key. This argument is only valid if --key-type is set to mldsa. (default: 2)

--hash-alg={sha256,sha384,sha512}

Hashing algorithm to use for signing RSA and ECDSA keys. This argument is only valid if --key-type is rsa or ecdsa. (default: "sha256")

--cipher-alg={des-ede3-cbc,aes-256-cbc}

Cipher to use for encrypting key files. (default: "aes-256-cbc")

Certificate Authority File Options

--ca-file=STRING

Path where the public CA certificate will be stored. (default: "./ca.crt")

--ca-mode=0644

File mode of the created CA certificate.

--ca-key-file=STRING

Path where the CA's private key will be stored. If unspecified, the key will be destroyed rather than written to the disk.

--ca-key-mode=0600

File mode of the created CA key.

--ca-key-password=STRING

Provide a password for the CA key file. Note that this will be visible in the process table for all users, so it should be used for testing purposes only. Use --ca-keypassfile or --ca-key-password-prompt for secure password entry.

--ca-key-passfile=STRING

A file containing the password to encrypt the CA key file.

-C, --ca-key-password-prompt

Prompt to enter a password for the CA key file.

Certificate Revocation List File Options

--crl-file=STRING

Path where an (empty) Certificate Revocation List file will be created, for applications that expect such a file to exist. If unspecified, no such file will be created.

--crl-mode=0644

File mode of the created Certificate Revocation List.

Service Certificate File Options

--cert-file=STRING

Path where the public service certificate will be stored. (default "./service.pem")

--cert-mode=0644

File mode of the created certificate.

--cert-key-file=STRING

Path where the service's private key will be stored. (default "service-key.pem")

--cert-key-mode=0600

File mode of the created certificate key.

-p, --cert-key-password=STRING

Provide a password for the service key file. Note that this will be visible in the process table for all users, so this flag should be used for testing purposes only. Use --cert-keypassfile or --cert-key-password-prompt for secure password entry.

--cert-key-passfile=STRING

A file containing the password to encrypt the service key file.

-P, --cert-key-password-prompt

Prompt to enter a password for the service key file.

Client Authentication Certificate File Options

--client-file=STRING

Path where a client authentication certificate will be stored.

--client-mode=0644

File mode of the created certificate.

--client-key-file=STRING

Path where the client's private key will be stored. (default is the client-file)

--client-key-mode=0600

File mode of the created certificate key.

--client-key-password=STRING

Provide a password for the client key file. Note that this will be visible in the process table for all users, so this flag should be used for testing purposes only. Use --client-keypassfile or --client-key-password-prompt for secure password entry.

--client-key-passfile=STRING

A file containing the password to encrypt the client key file.

--client-key-password-prompt

Prompt to enter a password for the client key file.

Diffie-Hellman Parameter File Options

--dhparams-file=STRING

A file to contain a set of Diffie-Hellman parameters. (Default: not created)

--dhparams-named-group=STRING

Output well-known DH parameters. The available named groups are: ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, modp_2048, modp_3072, modp_4096, modp_6144, modp_8192, modp_1536, dh_1024_160, dh_2048_224, dh_2048_256. (Default: "ffdhe4096")

--dhparams-generator={2,3,5}

The generator value for dhparams. (default: 2)


sshguard

package: sshguard

title: sshguard(8)

text:
# sshguard(8)

## Name
sshguard - block brute-force attacks by aggregating system logs

## SYNOPSIS
sshguard [-hv] [-a threshold] [-b threshold:blacklist_file] [-i pidfile] [-p blocktime] [-s detection_time] [-w address | whitelist_file] [file ...]

## DESCRIPTION
sshguard protects hosts from brute-force attacks against SSH and other services. It aggregates system logs and blocks repeat offenders using one of several firewall backends.

sshguard can monitor log files and the standard output of running a shell command. Log messages are parsed line-by-line for recognized attack patterns. Attackers are blocked when enough attack patterns are detected in a configurable time interval. Attackers are blocked temporarily but can also be permanently blocked using the blacklist option.

sshguard must be configured before its first run. See sshguard-setup(7).

## OPTIONS
-a threshold (default 30)

Each detected attack increases an attacker's attack score, usually by 10. Block attackers when their attack score exceeds threshold.

-b threshold:blacklist_file

Blacklist an attacker when its attack score exceeds threshold. Blacklisted addresses are written to blacklist-file and never unblocked, even after restarting sshguard.

-i pidfile

Write the PID of sshguard to pidfile. pidfile is removed when sshguard exits.

-p blocktime (default 120)

Block first-time attackers for blocktime seconds. Subsequent blocks increase in duration by a factor of 2. Since sshguard unblocks attackers at random intervals, actual block times may be somewhat longer.

-s detection_time (default 1800)

Reset an attacker's attack score after detection_time seconds since the last attack. This means that attackers who attack every detection_time seconds are never blocked by sshguard. However, an increased detection_time may have an impact on legitimate users.

[-w address | whitelist_file]

Whitelist a single address, hostname, or address block given as address. This option can be given multiple times. Alternatively, provide an absolute path to a whitelist_file containing addresses to whitelist. See WHITELISTING.

-h

Print usage information and exit.

-v

Print version information and exit.

## ENVIRONMENT
SSHGUARD_USER

When set, sandboxed processes drop permissions by changing to this user. Normally set and overridden in sshguard.conf using the SSHGUARD_USER variable.

SSHGUARD_DEBUG

Set to enable verbose output from sshg-blocker.

SSHGUARD_STATS_DIR

When set, write Prometheus-compatible statistics to .prom files in this directory every minute. The STATS_DIR variable in sshguard.conf will set and override this environment variable.

## FILES
%PREFIX%/etc/sshguard.conf

See sample configuration file.

## WHITELISTING
Whitelisted addresses are never blocked. Addresses can be specified on the command line or be stored in a file.

On the command line, give the -w option one or more times with an IP address, CIDR address block, or hostname as an argument. Hostnames are resolved once at startup. If a hostname resolves to multiple addresses, all of them are whitelisted. For example:

```
sshguard -w 192.168.1.10 -w 192.168.0.0/24 -w friend.example.com

    -w 2001:0db8:85a3:0000:0000:8a2e:0370:7334

    -w 2002:836b:4179::836b:0000/126
```

If the argument to -w begins with a forward slash ('/') or dot ('.'), the argument is treated as the path to a whitelist file.

The whitelist file contains comments (lines beginning with '#'), addresses, address blocks, or hostnames, one per line.

## SEE ALSO
sshguard-setup(7)


sslh

package: sslh

title: sslh(8)

summary: protocol demultiplexer

text:
# sslh(8)

## NAME

```
 sslh - protocol demultiplexer
```

## SYNOPSIS
sslh [-Fconfig file] [-t num] [--transparent] [-p listening address [-p listening address ...] [--tls target address for TLS] [--ssh target address for SSH] [--openvpn target address for OpenVPN] [--http target address for HTTP] [--xmpp target address for XMPP] [--tinc target address for TINC] [--anyprot default target address] [--on-timeout protocol name] [-u username] [-C chroot] [-P pidfile] [-v n] [-i] [-V] [-f] [-n]

## DESCRIPTION
sslh accepts connections on specified ports, and forwards them further based on tests performed on the first data packet sent by the remote client.

Probes for HTTP, TLS, SSH, OpenVPN, tinc, XMPP are implemented, and any other protocol that can be tested using a regular expression, can be recognised. A typical use case is to allow serving several services on port 443 (e.g. to connect to ssh from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port.

Hence sslh acts as a protocol demultiplexer, or a switchboard. Its name comes from its original function to serve SSH and HTTPS on the same port.

### Libwrap support
One drawback of sslh is that the servers do not see the original IP address of the client anymore, as the connection is forwarded through sslh.

For this reason, sslh can be compiled with libwrap to check accesses defined in /etc/hosts.allow and /etc/hosts.deny. Libwrap services can be defined using the configuration file.

### Configuration file
A configuration file can be supplied to sslh. Command line arguments override file settings. sslh uses libconfig to parse the configuration file, so the general file format is indicated in <http://www.hyperrealm.com/libconfig/libconfig_manual.html>. Please refer to the example configuration file provided with sslh for the specific format (Options have the same names as on the command line, except for the list of listen ports and the list of protocols).

The configuration file makes it possible to specify protocols using regular expressions: a list of regular expressions is given as the regex_patterns parameter, and if the first packet received from the client matches any of these expressions, sslh connects to that protocol.

### Probing protocols
When receiving an incoming connection, sslh will read the first bytes sent by the connecting client. It will then probe for the protocol in the order specified on the command line (or the configuration file). Therefore --anyprot should alway be used last, as it always succeeds and further protocols will never be tried.

If no data is sent by the client, sslh will eventually time out and connect to the protocol specified with --on-timeout, or ssh if none is specified.

### Logging
As a security/authorization program, sslh logs to the LOG_AUTH facility, with priority LOG_INFO for normal connections and LOG_ERR for failures.

## OPTIONS
-Ffilename, --config filename

Uses filename as configuration file. If other command-line options are specified, they will override the configuration file's settings.

-t num, --timeout num

Timeout before forwarding the connection to the timeout protocol (which should usually be SSH). Default is 2s.

--on-timeout protocol name

Name of the protocol to connect to after the timeout period is over. Default is to forward to the first specified protocol. It usually makes sense to specify 'ssh' as the timeout protocol, as the SSH specification does not tell who is supposed to speak first and a large number of SSH clients wait for the server to send its banner.

--transparent

Makes sslh behave as a transparent proxy, i.e. the receiving service sees the original client's IP address. This works on Linux only and involves iproute2 settings. In some cases also iptables/nftables settings are needed. Refer to the README or <https://github.com/ftasnetamot/sslh/blob/2014-08-16--close-filehandles-with-detach/doc/simple_transparent_proxy.md> for more information.

-p listening address, --listen listening address

Interface and port on which to listen, e.g. foobar:443, where foobar is the name of an interface (typically the IP address on which the Internet connection ends up). This can be specified several times to bind sslh to several addresses.

--tls target address

Interface and port on which to forward SSL connection, typically localhost:443. Note that you can set sslh to listen on ext_ip:443 and httpd to listen on localhost:443: this allows clients inside your network to just connect directly to httpd.

Also, sslh probes for TLS handshakes and will reject connections from clients requesting SSLv2. This is compliant with RFC6176 which prohibits the usage of SSLv2. If you wish to accept SSLv2, use --anyprot instead.

--ssh target address

Interface and port on which to forward SSH connections, typically localhost:22.

--openvpn target address

Interface and port on which to forward OpenVPN connections, typically localhost:1194.

--xmpp target address

Interface and port on which to forward XMPP connections, typically localhost:5222.

--http target address

Interface and port on which to forward HTTP connections, typically localhost:80.

--tinc target address

Interface and port on which to forward tinc connections, typically localhost:655. This is experimental. If you use this feature, please report the results (even if it works!)

--anyprot target address

Interface and port on which to forward if no other protocol has been found. Because sslh tries protocols in the order specified on the command line, this should be specified last. If no default is specified, sslh will forward unknown protocols to the first protocol specified.

-v, --verbose n

Override all verboseness. Refer to example.cfg for all verbose sub-options.

-n, --numeric

Do not attempt to resolve hostnames: logs will contain IP addresses. This is mostly useful if the system's DNS is slow and running the sslh-select variant, as DNS requests will hang all connections.

-V

Prints sslh version.

-u username, --user username

Requires to run under the specified username.

-C chroot, --chroot chroot

Requires to run under the specified chroot.

-P pidfile, --pidfile pidfile

Specifies a file in which to write the PID of the main server.

-i, --inetd

Runs as an inetd server. Options -P (PID file), -p (listen address), -u (user) are ignored.

-f, --foreground

Runs in foreground. The server will not fork and will remain connected to the terminal. Messages normally sent to syslog will also be sent to stderr.

--background

Runs in background. This overrides foreground if set in the configuration file (or on the command line, but there is no point setting both on the command line unless you have a personality disorder).

## FILES
/etc/init.d/sslh

Start-up script. The standard actions start, stop and restart are supported.

/etc/default/sslh

Server configuration. These are environment variables loaded by the start-up script and passed to sslh as command-line arguments. Refer to the OPTIONS section for a detailed explanation of the variables used by sslh.

## SEE ALSO
The latest version is available from <https://github.com/yrutschle/sslh>. There you can find a more detailed and recent documentation.

## AUTHOR
Written by Yves Rutschle.


ssmtp

package: ssmtp-tools

title: ssmtp(8)

summary: send a message using smtp

text:
# ssmtp(8)

## NAME
ssmtp, sendmail - send a message using smtp

## SYNOPSIS
ssmtp [ flags ] [ address ... ]

/usr/lib/sendmail [ flags ] [ address ... ]

## DESCRIPTION
ssmtp is a send-only sendmail emulator for machines which normally pick their mail up from a centralized mailhub (via pop, imap, nfs mounts or other means). It provides the functionality required for humans and programs to send mail via the standard or /usr/bin/mail user agents.

It accepts a mail stream on standard input with recipients specified on the command line and synchronously forwards the message to the mail transfer agent of a mailhub for the mailhub MTA to process. Failed messages are placed in dead.letter in the sender's home directory.

Config files allow one to specify the address to receive mail from root, daemon, etc.; a default mailhub; a default domain to be used in From: lines; and per-user From: addresses and mailhub names.

It does not attempt to provide all the functionality of sendmail: it is intended for use where other programs are the primary means of at last mail delivery. It is useful with pop/imap, or to simulate the Sun shared mail spool option for non-Sun machines, for machines whose sendmails are too difficult (or various) to configure, for machines with known disfeatures in their sendmails or for ones where there are ``mysterious problems''.

It does not do aliasing, which must be done either in the user agent or on the mailhub. Nor does it honor .forwards, which have to be done on the receiving host. It especially does not deliver to pipelines.

## OPTIONS
Most sendmail options are irrelevant to sSMTP. Those marked ``ignored'' or ``default'' have no effect on mail transfer. Those marked ``unsupported'' are fatal errors. Those marked ``simulated'' are not errors, but the result is for the program to exit with an informative message. A sort of fatal non-error.

-4

Forces ssmtp to use IPv4 addresses only.

-6

Forces ssmtp to use IPv6 addresses only.

-B body_type

(ignored) The message body MIME type: 7BIT or 8BITMIME.

-auusername

Specifies username for SMTP authentication.

-appassword

Specifies password for SMTP authentication.

-ammechanism

Specifies mechanism for SMTP authentication. (Only LOGIN and CRAM-MD5)

-ba

(unsupported) ARPANET mode. All input lines must end with a LINEFEED, and all messages will be generated with a CR-LF at the end. Also, the ``From:'' and ``Sender:'' fields are examined for the name of the sender.

-bd

(unsupported) Run as a daemon.

-bi

(ignored) Initialise the alias database.

-bm

(default) Deliver mail in the usual way.

-bp

(simulated) Print a summary of the mail queue.

-bs

(unsupported) Read SMTP commands from stdin.

-bt

(unsupported) Run in address test mode.

-bv

(unsupported) Verify names only.

-bz

(unsupported) Create the configuration freeze file.

-Cfile

Use alternate configuration file.

-dX

Set debugging value to X.

-E

(ignored) Don't trust userid of sender.

-Ffullname

Set the full name of the sender.

-fname

Sets the name of the ``from'' person. This option is valid only if no From: line is specified within the header of the email.

-hN

(ignored) Set the hop count to N.

-m

(ignored) Ignore originator in alias.

-Mid

(ignored) Attempt to deliver the queued message with message-id id.

-N dsn

(ignored) Set delivery status notification conditions to dsn.

-n

(default) Do not do aliasing.

-oAfile

(ignored) Use alternate alias file.

-oc

(ignored) Delay ``expensive'' connections.

-odx

(ignored) Set the delivery mode to interactive/synchronous, background or queue (Always interactive).

-oD

(ignored) Run newaliases if required.

-oex

(ignored) Set error processing to mail, write, print or quit. (Always print).

-oFmode

(ignored) The mode to use when creating temporary files.

-of

(ignored) Save UNIX-system-style ``From'' lines at the front of messages.

-ogN

(ignored) Set group ID to use when calling mailers.

-oHfile

(ignored) Set SMTP help file.

-oi

(default) Do not take dots on a line by themselves as a message terminator.

-oLn

(ignored) The log level.

-om

(default) Send to ``me'' (the sender) also if in an alias.

-oo

(unsupported) If set, this message may have old style headers.

-oQqueuedir

(ignored) Select the directory in which to queue messages.

-ortimeout

(ignored) The timeout on reads.

-oSfile

(ignored) Save statistics in the named file.

-os

(ignored) Always instantiate the queue.

-oTtime

(ignored) Set timeout on messages.

-otstz,dtz

(ignored) Set the name of the time zone.

-ouN

(ignored) Set the default user id for mailers.

-q[time]

(simulated) Process the queue.

-rname

Same as -f.

-Rstring

(ignored) Process queue for recipient.

-R return

(ignored) Set the amount of the message to be returned if the message bounces.

-t

Read message, searching for recipients. ``To:'', `Cc:'', and ``Bcc:'' lines will be scanned for people to send to. Any addresses in the argument list will be suppressed (not supported).

-v

Go into verbose mode.

-V

Say version and quit.

## REVERSE ALIASES
A reverse alias gives the From: address placed on a user's outgoing messages and (optionally) the mailhub these messages will be sent through. Example:

```
root:jdoe@isp.com:mail.isp.com
```

Messages root sends will be identified as from jdoe@isp.com and sent through mail.isp.com.

## FILES

/etc/ssmtp/ssmtp.conf - configuration file

/etc/ssmtp/revaliases - reverse aliases file

## SEE ALSO
RFC821, RFC822, ssmtp.conf(5).

## AUTHORS
Matt Ryan (mryan@debian.org) Hugo Haas (hugo@debian.org) Christoph Lameter (clameter@debian.org) Dave Collier-Brown (davecb@hobbes.ss.org)

## BUGS
sSMTP does not support exception lists to the -t option (never seen it used).

sSMTP will fail if the mailhub is unreachable.


package: sssd

title: sss_cache(8)

summary: perform cache cleanup

text:
# sss_cache(8)

## NAME
sss_cache - perform cache cleanup

## SYNOPSIS
sss_cache [options]

## DESCRIPTION
sss_cache invalidates records in SSSD cache. Invalidated records are forced to be reloaded from server as soon as related SSSD backend is online. Options that invalidate a single object only accept a single provided argument.

## OPTIONS
-E,--everything

Invalidate all cached entries.

-u,--user login

Invalidate specific user.

-U,--users

Invalidate all user records. This option overrides invalidation of specific user if it was also set.

-g,--group group

Invalidate specific group.

-G,--groups

Invalidate all group records. This option overrides invalidation of specific group if it was also set.

-n,--netgroup netgroup

Invalidate specific netgroup.

-N,--netgroups

Invalidate all netgroup records. This option overrides invalidation of specific netgroup if it was also set.

-s,--service service

Invalidate specific service.

-S,--services

Invalidate all service records. This option overrides invalidation of specific service if it was also set.

-a,--autofs-map autofs-map

Invalidate specific autofs maps.

-A,--autofs-maps

Invalidate all autofs maps. This option overrides invalidation of specific map if it was also set.

-h,--ssh-host hostname

Invalidate SSH public keys of a specific host.

-H,--ssh-hosts

Invalidate SSH public keys of all hosts. This option overrides invalidation of SSH public keys of specific host if it was also set.

-r,--sudo-rule rule

Invalidate particular sudo rule.

-R,--sudo-rules

Invalidate all cached sudo rules. This option overrides invalidation of specific sudo rule if it was also set.

-d,--domain domain

Restrict invalidation process only to a particular domain.

-?,--help

Display help message and exit.

## EFFECTS ON THE FAST MEMORY CACHE
sss_cache also invalidates the memory cache. Since the memory cache is a file which is mapped into the memory of each process which called SSSD to resolve users or groups the file cannot be truncated. A special flag is set in the header of the file to indicate that the content is invalid and then the file is unlinked by SSSD's NSS responder and a new cache file is created. Whenever a process is now doing a new lookup for a user or a group it will see the flag, close the old memory cache file and map the new one into its memory. When all processes which had opened the old memory cache file have closed it while looking up a user or a group the kernel can release the occupied disk space and the old memory cache file is finally removed completely.

A special case is long running processes which are doing user or group lookups only at startup, e.g. to determine the name of the user the process is running as. For those lookups the memory cache file is mapped into the memory of the process. But since there will be no further lookups this process would never detect if the memory cache file was invalidated and hence it will be kept in memory and will occupy disk space until the process stops. As a result calling sss_cache might increase the disk usage because old memory cache files cannot be removed from the disk because they are still mapped by long running processes.

A possible work-around for long running processes which are looking up users and groups only at startup or very rarely is to run them with the environment variable SSS_NSS_USE_MEMCACHE set to "NO" so that they won't use the memory cache at all and not map the memory cache file into the memory. In general a better solution is to tune the cache timeout parameters so that they meet the local expectations and calling sss_cache is not needed.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


sssd

title: sssd(8)

summary: System Security Services Daemon

text:
# sssd(8)

## NAME
sssd - System Security Services Daemon

## SYNOPSIS
sssd [options]

## DESCRIPTION
SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources as well as D-Bus interface. It is also the basis to provide client auditing and policy services for projects like FreeIPA. It provides a more robust database to store local users as well as extended user data.

## OPTIONS
-d,--debug-level LEVEL

SSSD supports two representations for specifying the debug level. The simplest is to specify a decimal value from 0-9, which represents enabling that level and all lower-level debug messages. The more comprehensive option is to specify a hexadecimal bitmask to enable or disable specific levels (such as if you wish to suppress a level). Please note that each SSSD service logs into its own log file. Also please note that enabling “debug_level” in the “[sssd]” section only enables debugging just for the sssd process itself, not for the responder or provider processes. The “debug_level” parameter should be added to all sections that you wish to produce debug logs from.

In addition to changing the log level in the config file using the “debug_level” parameter, which is persistent, but requires SSSD restart, it is also possible to change the debug level on the fly using the sss_debuglevel(8) tool.

Currently supported debug levels:

0, 0x0010: Fatal failures. Anything that would prevent SSSD from starting up or causes it to cease running.

1, 0x0020: Critical failures. An error that doesn't kill SSSD, but one that indicates that at least one major feature is not going to work properly.

2, 0x0040: Serious failures. An error announcing that a particular request or operation has failed.

3, 0x0080: Minor failures. These are the errors that would percolate down to cause the operation failure of 2.

4, 0x0100: Configuration settings.

5, 0x0200: Function data.

6, 0x0400: Trace messages for operation functions.

7, 0x1000: Trace messages for internal control functions.

8, 0x2000: Contents of function-internal variables that may be interesting.

9, 0x4000: Extremely low-level tracing information.

9, 0x20000: Performance and statistical data, please note that due to the way requests are processed internally the logged execution time of a request might be longer than it actually was.

10, 0x10000: Even more low-level libldb tracing information. Almost never really required.

To log required bitmask debug levels, simply add their numbers together as shown in following examples:

Example: To log fatal failures, critical failures, serious failures and function data use 0x0270.

Example: To log fatal failures, configuration settings, function data, trace messages for internal control functions use 0x1310.

Note: The bitmask format of debug levels was introduced in 1.7.0.

Default: 0x0070 (i.e. fatal, critical and serious failures; corresponds to setting 2 in decimal notation)

--debug-timestamps=mode

1: Add a timestamp to the debug messages 0: Disable timestamp in the debug messages

Default: 1

--debug-microseconds=mode

1: Add microseconds to the timestamp in debug messages 0: Disable microseconds in timestamp

Default: 0

--logger=value

Location where SSSD will send log messages. stderr: Redirect debug messages to standard error output.

files: Redirect debug messages to the log files. By default, the log files are stored in /var/log/sssd and there are separate log files for every SSSD service and domain.

journald: Redirect debug messages to systemd-journald

Default: not set (fall back to journald if available, otherwise to stderr)

-D,--daemon

Become a daemon after starting up.

-i,--interactive

Run in the foreground, don't become a daemon.

-c,--config

Specify a non-default config file. The default is /etc/sssd/sssd.conf. For reference on the config file syntax and options, consult the sssd.conf(5) manual page.

-?,--help

Display help message and exit.

--version

Print version number and exit.

## SIGNALS
SIGTERM/SIGINT

Informs the SSSD to gracefully terminate all of its child processes and then shut down the monitor.

SIGHUP

Tells the SSSD to stop writing to its current debug file descriptors and to close and reopen them. This is meant to facilitate log rolling with programs like logrotate.

SIGUSR1

Tells the SSSD to simulate offline operation for the duration of the “offline_timeout” parameter. This is useful for testing. The signal can be sent to either the sssd process or any sssd_be process directly.

SIGUSR2

Tells the SSSD to go online immediately. This is useful for testing. The signal can be sent to either the sssd process or any sssd_be process directly.

SIGRTMIN+1

Tells the SSSD to reschedule the periodic tasks. The internal watchdog sends this signal to the providers when a clock shift is detected although it can be sent to any sssd_be process directly.

## EXIT STATUS
0

SSSD was shutdown gracefully.

1

Bad configuration or command line option.

2

Memory allocation error.

6

SSSD is already running.

Other codes

Other codes denote different errors, most probably about missing required access rights. See SSSD and system logs for details.

## NOTES
If the environment variable SSS_NSS_USE_MEMCACHE is set to "NO", client applications will not use the fast in-memory cache.

If the environment variable SSS_LOCKFREE is set to "NO", requests from multiple threads of a single application will be serialized.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


package: sssd-client

title: pam_sss(8)

summary: PAM module for SSSD

text:
# pam_sss(8)

## NAME
pam_sss - PAM module for SSSD

## SYNOPSIS
pam_sss.so [quiet] [forward_pass] [use_first_pass] [use_authtok] [retry=N] [ignore_unknown_user] [ignore_authinfo_unavail] [domains=X] [allow_missing_name] [prompt_always] [try_cert_auth] [require_cert_auth] [allow_chauthtok_by_root]

## DESCRIPTION
pam_sss.so is the PAM interface to the System Security Services daemon (SSSD). Errors and results are logged through syslog(3) with the LOG_AUTHPRIV facility.

## OPTIONS
quiet

Suppress log messages for unknown users.

forward_pass

If forward_pass is set the entered password is put on the stack for other PAM modules to use.

use_first_pass

The argument use_first_pass forces the module to use a previous stacked modules password and will never prompt the user - if no password is available or the password is not appropriate, the user will be denied access.

use_authtok

When password changing enforce the module to set the new password to the one provided by a previously stacked password module.

retry=N

If specified the user is asked another N times for a password if authentication fails. Default is 0. Please note that this option might not work as expected if the application calling PAM handles the user dialog on its own. A typical example is sshd with PasswordAuthentication.

ignore_unknown_user

If this option is specified and the user does not exist, the PAM module will return PAM_IGNORE. This causes the PAM framework to ignore this module.

ignore_authinfo_unavail

Specifies that the PAM module should return PAM_IGNORE if it cannot contact the SSSD daemon. This causes the PAM framework to ignore this module.

domains

Allows the administrator to restrict the domains a particular PAM service is allowed to authenticate against. The format is a comma-separated list of SSSD domain names, as specified in the sssd.conf file. NOTE: If this is used for a service not running as root user, e.g. a web-server, it must be used in conjunction with the “pam_trusted_users” and “pam_public_domains” options. Please see the sssd.conf(5) manual page for more information on these two PAM responder options.

allow_missing_name

The main purpose of this option is to let SSSD determine the user name based on additional information, e.g. the certificate from a Smartcard. The current use case are login managers which can monitor a Smartcard reader for card events. In case a Smartcard is inserted the login manager will call a PAM stack which includes a line like

```
auth sufficient pam_sss.so allow_missing_name

```

In this case SSSD will try to determine the user name based on the content of the Smartcard, returns it to pam_sss which will finally put it on the PAM stack.

prompt_always

Always prompt the user for credentials. With this option credentials requested by other PAM modules, typically a password, will be ignored and pam_sss will prompt for credentials again. Based on the pre-auth reply by SSSD pam_sss might prompt for a password, a Smartcard PIN or other credentials.

try_cert_auth

Try to use certificate based authentication, i.e. authentication with a Smartcard or similar devices. If a Smartcard is available and the service is allowed for Smartcard authentication the user will be prompted for a PIN and the certificate based authentication will continue If no Smartcard is available or certificate based authentication is not allowed for the current service PAM_AUTHINFO_UNAVAIL is returned.

require_cert_auth

Do certificate based authentication, i.e. authentication with a Smartcard or similar devices. If a Smartcard is not available the user will be prompted to insert one. SSSD will wait for a Smartcard until the timeout defined by p11_wait_for_card_timeout passed, please see sssd.conf(5) for details. If no Smartcard is available after the timeout or certificate based authentication is not allowed for the current service PAM_AUTHINFO_UNAVAIL is returned.

allow_chauthtok_by_root

By default the chauthtok PAM action will short-circuit to returning PAM_SUCCESS when pam_sss.so is invoked by root user. This option disables this behavior allowing to change auth tokens when running as root.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

If SSSD's PAM responder is not running, e.g. if the PAM responder socket is not available, pam_sss will return PAM_USER_UNKNOWN when called as account module to avoid issues with users from other sources during access control.

## RETURN VALUES
PAM_SUCCESS

The PAM operation finished successfully.

PAM_USER_UNKNOWN

The user is not known to the authentication service or the SSSD's PAM responder is not running.

PAM_AUTH_ERR

Authentication failure. Also, could be returned when there is a problem with getting the certificate.

PAM_PERM_DENIED

Permission denied. The SSSD log files may contain additional information about the error.

PAM_IGNORE

See options ignore_unknown_user and ignore_authinfo_unavail.

PAM_AUTHTOK_ERR

Unable to obtain the new authentication token. Also, could be returned when the user authenticates with certificates and multiple certificates are available, but the installed version of GDM does not support selection from multiple certificates.

PAM_AUTHINFO_UNAVAIL

Unable to access the authentication information. This might be due to a network or hardware failure.

PAM_BUF_ERR

A memory error occurred. Also, could be returned when options use_first_pass or use_authtok were set, but no password was found from the previously stacked PAM module.

PAM_SYSTEM_ERR

A system error occurred. The SSSD log files may contain additional information about the error.

PAM_CRED_ERR

Unable to set the credentials of the user.

PAM_CRED_INSUFFICIENT

The application does not have sufficient credentials to authenticate the user. For example, missing PIN during smartcard authentication or missing factor during two-factor authentication.

PAM_SERVICE_ERR

Error in service module.

PAM_NEW_AUTHTOK_REQD

The user's authentication token has expired.

PAM_ACCT_EXPIRED

The user account has expired.

PAM_SESSION_ERR

Unable to fetch IPA Desktop Profile rules or user info.

PAM_CRED_UNAVAIL

Unable to retrieve Kerberos user credentials.

PAM_NO_MODULE_DATA

No authentication method was found by Kerberos. This might happen if the user has a Smartcard assigned but the pkint plugin is not available on the client.

PAM_CONV_ERR

Conversation failure.

PAM_AUTHTOK_LOCK_BUSY

No KDC suitable for password change is available.

PAM_ABORT

Unknown PAM call.

PAM_MODULE_UNKNOWN

Unsupported PAM task or command.

PAM_BAD_ITEM

The authentication module cannot handle Smartcard credentials.

## FILES
If a password reset by root fails, because the corresponding SSSD provider does not support password resets, an individual message can be displayed. This message can e.g. contain instructions about how to reset a password.

The message is read from the file pam_sss_pw_reset_message.LOC where LOC stands for a locale string returned by setlocale(3). If there is no matching file the content of pam_sss_pw_reset_message.txt is displayed. Root must be the owner of the files and only root may have read and write permissions while all other users must have only read permissions.

These files are searched in the directory /etc/sssd/customize/DOMAIN_NAME/. If no matching file is present a generic message is displayed.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


title: pam_sss_gss(8)

text:
# pam_sss_gss(8)

## NAME
pam_sss_gss - PAM module for SSSD GSSAPI authentication

## SYNOPSIS
pam_sss_gss.so [debug]

## DESCRIPTION
pam_sss_gss.so authenticates user over GSSAPI in cooperation with SSSD.

This module will try to authenticate the user using the GSSAPI hostbased service name host@hostname which translates to host/hostname@REALM Kerberos principal. The REALM part of the Kerberos principal name is derived by Kerberos internal mechanisms and it can be set explicitly in configuration of [domain_realm] section in /etc/krb5.conf.

SSSD is used to provide desired service name and to validate the user's credentials using GSSAPI calls. If the service ticket is already present in the Kerberos credentials cache or if user's ticket granting ticket can be used to get the correct service ticket then the user will be authenticated.

If pam_gssapi_check_upn is True (default) then SSSD requires that the credentials used to obtain the service tickets can be associated with the user. This means that the principal that owns the Kerberos credentials must match with the user principal name as defined in LDAP.

To enable GSSAPI authentication in SSSD, set pam_gssapi_services option in [pam] or domain section of sssd.conf. The service credentials need to be stored in SSSD's keytab (it is already present if you use ipa or ad provider). The keytab location can be set with krb5_keytab option. See sssd.conf(5) and sssd-krb5(5) for more details on these options.

Some Kerberos deployments allow to associate authentication indicators with a particular pre-authentication method used to obtain the ticket granting ticket by the user. pam_sss_gss.so allows to enforce presence of authentication indicators in the service tickets before a particular PAM service can be accessed.

If pam_gssapi_indicators_map is set in the [pam] or domain section of sssd.conf, then SSSD will perform a check of the presence of any configured indicators in the service ticket.

## OPTIONS
debug

Print debugging information.

## MODULE TYPES PROVIDED
Only the auth module type is provided.

## RETURN VALUES
PAM_SUCCESS

The PAM operation finished successfully.

PAM_USER_UNKNOWN

The user is not known to the authentication service or the GSSAPI authentication is not supported.

PAM_AUTH_ERR

Authentication failure.

PAM_AUTHINFO_UNAVAIL

Unable to access the authentication information. This might be due to a network or hardware failure.

PAM_SYSTEM_ERR

A system error occurred. The SSSD log files may contain additional information about the error.

## EXAMPLES
The main use case is to provide password-less authentication in sudo but without the need to disable authentication completely. To achieve this, first enable GSSAPI authentication for sudo in sssd.conf:

```
[domain/MYDOMAIN]
pam_gssapi_services = sudo, sudo-i

```

And then enable the module in desired PAM stack (e.g. /etc/pam.d/sudo and /etc/pam.d/sudo-i).

```
...
auth sufficient pam_sss_gss.so
...

```

## TROUBLESHOOTING
SSSD logs, pam_sss_gss debug output and syslog may contain helpful information about the error. Here are some common issues:

1. I have KRB5CCNAME environment variable set and the authentication does not work: Depending on your sudo version, it is possible that sudo does not pass this variable to the PAM environment. Try adding KRB5CCNAME to env_keep in /etc/sudoers or in your LDAP sudo rules default options.

2. Authentication does not work and syslog contains "Server not found in Kerberos database": Kerberos is probably not able to resolve correct realm for the service ticket based on the hostname. Try adding the hostname directly to [domain_realm] in /etc/krb5.conf like so:

3. Authentication does not work and syslog contains "No Kerberos credentials available": You don't have any credentials that can be used to obtain the required service ticket. Use kinit or authenticate over SSSD to acquire those credentials.

4. Authentication does not work and SSSD sssd-pam log contains "User with UPN [$UPN] was not found." or "UPN [$UPN] does not match target user [$username].": You are using credentials that can not be mapped to the user that is being authenticated. Try to use kswitch to select different principal, make sure you authenticated with SSSD or consider disabling pam_gssapi_check_upn.

```
[domain_realm]
.myhostname = MYREALM

```

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


title: sssd_krb5_localauth_plugin(8)

summary: Kerberos local authorization plugin

text:
# sssd_krb5_localauth_plugin(8)

## NAME
sssd_krb5_localauth_plugin - Kerberos local authorization plugin

## DESCRIPTION
The Kerberos local authorization plugin sssd_krb5_localauth_plugin is used by libkrb5 to either find the local name for a given Kerberos principal or to check if a given local name and a given Kerberos principal relate to each other.

SSSD handles the local names for users from a remote source and can read the Kerberos user principal name from the remote source as well. With this information SSSD can easily handle the mappings mentioned above even if the local name and the Kerberos principal differ considerably.

Additionally with the information read from the remote source SSSD can help to prevent unexpected or unwanted mappings in case the user part of the Kerberos principal accidentally corresponds to a local name of a different user. By default libkrb5 might just strip the realm part of the Kerberos principal to get the local name which would lead to wrong mappings in this case.

## CONFIGURATION
The Kerberos local authorization plugin must be enabled explicitly in the Kerberos configuration, see krb5.conf(5). SSSD will create a config snippet with the content like e.g.

```
[plugins]

 localauth = {

  disable = an2ln

  module = sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so

 }
```

automatically in the SSSD's public Kerberos configuration snippet directory. If this directory is included in the local Kerberos configuration the plugin will be enabled automatically.

This configuration snippet also disables the an2ln module provided by MIT Kerberos if SSSD is configured to use the AD or IPA provider. In those environments sssd_krb5_localauth_plugin can reliably map the system user names to Kerberos principals. A fallback to an2ln might cause issues in environments where users have the privilege to create Kerberos principals on their own which might collide with names of other users used in the system. Other modules provided by MIT Kerberos, e.g. k5login are not affected.

Note: If using “auth_provider = krb5” then sssd_krb5_localauth_plugin is not used, therefore the above text is not applicable.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


title: sssd_krb5_locator_plugin(8)

summary: Kerberos locator plugin

text:
# sssd_krb5_locator_plugin(8)

## NAME
sssd_krb5_locator_plugin - Kerberos locator plugin

## DESCRIPTION
The Kerberos locator plugin sssd_krb5_locator_plugin is used by libkrb5 to find KDCs for a given Kerberos realm. SSSD provides such a plugin to guide all Kerberos clients on a system to a single KDC. In general it should not matter to which KDC a client process is talking to. But there are cases, e.g. after a password change, where not all KDCs are in the same state because the new data has to be replicated first. To avoid unexpected authentication failures and maybe even account lockings it would be good to talk to a single KDC as long as possible.

libkrb5 will search the locator plugin in the libkrb5 sub-directory of the Kerberos plugin directory, see plugin_base_dir in krb5.conf(5) for details. The plugin can only be disabled by removing the plugin file. There is no option in the Kerberos configuration to disable it. But the SSSD_KRB5_LOCATOR_DISABLE environment variable can be used to disable the plugin for individual commands. Alternatively the SSSD option krb5_use_kdcinfo=False can be used to not generate the data needed by the plugin. With this the plugin is still called but will provide no data to the caller so that libkrb5 can fall back to other methods defined in krb5.conf.

The plugin reads the information about the KDCs of a given realm from a file called kdcinfo.REALM. The file should contain one or more DNS names or IP addresses either in dotted-decimal IPv4 notation or the hexadecimal IPv6 notation. An optional port number can be added to the end separated with a colon, the IPv6 address has to be enclosed in squared brackets in this case as usual. Valid entries are:

•kdc.example.com

•kdc.example.com:321

•1.2.3.4

•5.6.7.8:99

•2001:db8:85a3::8a2e:370:7334

•[2001:db8:85a3::8a2e:370:7334]:321

SSSD's krb5 auth-provider which is used by the IPA and AD providers as well adds the address of the current KDC or domain controller SSSD is using to this file.

In environments with read-only and read-write KDCs where clients are expected to use the read-only instances for the general operations and only the read-write KDC for config changes like password changes a kpasswdinfo.REALM is used as well to identify read-write KDCs. If this file exists for the given realm the content will be used by the plugin to reply to requests for a kpasswd or kadmin server or for the MIT Kerberos specific master KDC. If the address contains a port number the default KDC port 88 will be used for the latter.

## NOTES
Not all Kerberos implementations support the use of plugins. If sssd_krb5_locator_plugin is not available on your system you have to edit /etc/krb5.conf to reflect your Kerberos setup.

If the environment variable SSSD_KRB5_LOCATOR_DEBUG is set to any value debug messages will be sent to stderr.

If the environment variable SSSD_KRB5_LOCATOR_DISABLE is set to any value the plugin is disabled and will just return KRB5_PLUGIN_NO_HANDLE to the caller.

If the environment variable SSSD_KRB5_LOCATOR_IGNORE_DNS_FAILURES is set to any value plugin will try to resolve all DNS names in kdcinfo file. By default plugin returns KRB5_PLUGIN_NO_HANDLE to the caller immediately on first DNS resolving failure.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


sssd-kcm

package: sssd-kcm

title: sssd-kcm(8)

summary: SSSD Kerberos Cache Manager

text:
# sssd-kcm(8)

## NAME
sssd-kcm - SSSD Kerberos Cache Manager

## DESCRIPTION
This manual page describes the configuration of the SSSD Kerberos Cache Manager (KCM). KCM is a process that stores, tracks and manages Kerberos credential caches. It originates in the Heimdal Kerberos project, although the MIT Kerberos library also provides client side (more details on that below) support for the KCM credential cache.

In a setup where Kerberos caches are managed by KCM, the Kerberos library (typically used through an application, like e.g., kinit(1), is a “"KCM client"” and the KCM daemon is being referred to as a “"KCM server"”. The client and server communicate over a UNIX socket.

The KCM server keeps track of each credential caches's owner and performs access check control based on the UID and GID of the KCM client.

The KCM credential cache has several interesting properties:

•since the process runs in userspace, it is subject to UID namespacing, unlike the kernel keyring

•unlike the kernel keyring-based cache, which is shared between all containers, the KCM server is a separate process whose entry point is a UNIX socket

•the SSSD implementation stores the ccaches in a database, typically located at /var/lib/sss/secrets allowing the ccaches to survive KCM server restarts or machine reboots.

This allows the system to use a collection-aware credential cache, yet share the credential cache between some or no containers by bind-mounting the socket.

The KCM default client idle timeout is 5 minutes, this allows more time for user interaction with command line tools such as kinit.

## USING THE KCM CREDENTIAL CACHE
In order to use KCM credential cache, it must be selected as the default credential type in krb5.conf(5), The credentials cache name must be only “KCM:” without any template expansions. For example:

```
[libdefaults]

    default_ccache_name = KCM:

```

Next, make sure the Kerberos client libraries and the KCM server must agree on the UNIX socket path. By default, both use the same path /var/run/.heim_org.h5l.kcm-socket. To configure the Kerberos library, change its “kcm_socket” option which is described in the krb5.conf(5) manual page.

Finally, make sure the SSSD KCM server can be contacted. The KCM service is typically socket-activated by systemd(1). Unlike other SSSD services, it cannot be started by adding the “kcm” string to the “service” directive.

```
systemctl start sssd-kcm.socket
systemctl enable sssd-kcm.socket

```

Please note your distribution may already configure the units for you.

## THE CREDENTIAL CACHE STORAGE
The credential caches are stored in a database, much like SSSD caches user or group entries. The database is typically located at “/var/lib/sss/secrets”.

## OBTAINING DEBUG LOGS
The sssd-kcm service is typically socket-activated systemd(1). To generate debug logs, add the following either to the /etc/sssd/sssd.conf file directly or as a configuration snippet to /etc/sssd/conf.d/ directory:

```
[kcm]
debug_level = 10

```

Then, restart the sssd-kcm service:

```
systemctl restart sssd-kcm.service

```

Finally, run whatever use-case doesn't work for you. The KCM logs will be generated at /var/log/sssd/sssd_kcm.log. It is recommended to disable the debug logs when you no longer need the debugging to be enabled as the sssd-kcm service can generate quite a large amount of debugging information.

Please note that configuration snippets are, at the moment, only processed if the main configuration file at /etc/sssd/sssd.conf exists at all.

## RENEWALS
The sssd-kcm service can be configured to attempt TGT renewal for renewable TGTs stored in the KCM ccache. Renewals are only attempted when half of the ticket lifetime has been reached. KCM Renewals are configured when the following options are set in the [kcm] section:

```
tgt_renewal = true
krb5_renew_interval = 60m

```

SSSD can also inherit krb5 options for renewals from an existing domain.

```
tgt_renewal = true
tgt_renewal_inherit = domain-name

```

The following krb5 options can be configured in the [kcm] section to control renewal behavior, these options are described in detail below

```
krb5_renew_interval
krb5_renewable_lifetime
krb5_lifetime
krb5_validate
krb5_canonicalize
krb5_auth_timeout

```

## CONFIGURATION OPTIONS
The KCM service is configured in the “kcm” section of the sssd.conf file. Please note that because the KCM service is typically socket-activated, it is enough to just restart the “sssd-kcm” service after changing options in the “kcm” section of sssd.conf:

```
systemctl restart sssd-kcm.service

```

The KCM service is configured in the “kcm” For a detailed syntax reference, refer to the “FILE FORMAT” section of the sssd.conf(5) manual page.

The generic SSSD service options such as “debug_level” or “fd_limit” are accepted by the kcm service. Please refer to the sssd.conf(5) manual page for a complete list. In addition, there are some KCM-specific options as well.

socket_path (string)

The socket the KCM service will listen on. Default: /var/run/.heim_org.h5l.kcm-socket

Note: on platforms where systemd is supported, the socket path is overwritten by the one defined in the sssd-kcm.socket unit file.

max_ccaches (integer)

How many credential caches does the KCM database allow for all users. Default: 0 (unlimited, only the per-UID quota is enforced)

max_uid_ccaches (integer)

How many credential caches does the KCM database allow per UID. This is equivalent to “with how many principals you can kinit”. Default: 64

max_ccache_size (integer)

How big can a credential cache be per ccache. Each service ticket accounts into this quota. Default: 65536

tgt_renewal (bool)

Enables TGT renewals functionality. Default: False (Automatic renewals disabled)

tgt_renewal_inherit (string)

Domain to inherit krb5_* options from, for use with TGT renewals. Default: NULL

krb5_auth_timeout (integer)

Timeout in seconds after an online authentication request or change password request is aborted. If possible, the authentication request is continued offline. Default: 6

krb5_validate (boolean)

Verify with the help of krb5_keytab that the TGT obtained has not been spoofed. The keytab is checked for entries sequentially, and the first entry with a matching realm is used for validation. If no entry matches the realm, the last entry in the keytab is used. This process can be used to validate environments using cross-realm trust by placing the appropriate keytab entry as the last entry or the only entry in the keytab file. Default: false (IPA and AD provider: true)

Please note that the ticket validation is the first step when checking the PAC (see 'pac_check' in the sssd.conf(5) manual page for details). If ticket validation is disabled the PAC checks will be skipped as well.

krb5_renewable_lifetime (string)

Request a renewable ticket with a total lifetime, given as an integer immediately followed by a time unit: s for seconds

m for minutes

h for hours

d for days.

If there is no unit given, s is assumed.

NOTE: It is not possible to mix units. To set the renewable lifetime to one and a half hours, use '90m' instead of '1h30m'.

Default: not set, i.e. the TGT is not renewable

krb5_lifetime (string)

Request ticket with a lifetime, given as an integer immediately followed by a time unit: s for seconds

m for minutes

h for hours

d for days.

If there is no unit given s is assumed.

NOTE: It is not possible to mix units. To set the lifetime to one and a half hours please use '90m' instead of '1h30m'.

Default: not set, i.e. the default ticket lifetime configured on the KDC.

krb5_renew_interval (string)

The time in seconds between two checks if the TGT should be renewed. TGTs are renewed if about half of their lifetime is exceeded, given as an integer immediately followed by a time unit: s for seconds

m for minutes

h for hours

d for days.

If there is no unit given, s is assumed.

NOTE: It is not possible to mix units. To set the renewable lifetime to one and a half hours, use '90m' instead of '1h30m'.

If this option is not set or is 0 the automatic renewal is disabled.

Default: not set

krb5_canonicalize (boolean)

Specifies if the host and user principal should be canonicalized. This feature is available with MIT Kerberos 1.7 and later versions. Default: false

## SEE ALSO
sssd(8), sssd.conf(5),

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


package: sssd-tools

title: sss_debuglevel(8)

text:
# sss_debuglevel(8)

## NAME
sss_debuglevel - [DEPRECATED] change debug level while SSSD is running

## SYNOPSIS
sss_debuglevel [options] NEW_DEBUG_LEVEL

## DESCRIPTION
sss_debuglevel is deprecated and replaced by the sssctl debug-level command. Please refer to the sssctl man page for more information on sssctl usage.

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/


title: sss_obfuscate(8)

summary: obfuscate a clear text password

text:
# sss_obfuscate(8)

## NAME
sss_obfuscate - obfuscate a clear text password

## SYNOPSIS
sss_obfuscate [options] [PASSWORD]

## DESCRIPTION
sss_obfuscate converts a given password into human-unreadable format and places it into appropriate domain section of the SSSD config file.

The cleartext password is read from standard input or entered interactively. The obfuscated password is put into “ldap_default_authtok” parameter of a given SSSD domain and the “ldap_default_authtok_type” parameter is set to “obfuscated_password”. Refer to sssd-ldap(5) for more details on these parameters.

Please note that obfuscating the password provides no real security benefit as it is still possible for an attacker to reverse-engineer the password back. Using better authentication mechanisms such as client side certificates or GSSAPI is strongly advised.

## OPTIONS
-h,--help

Display help message and exit.

-s,--stdin

The password to obfuscate will be read from standard input.

-d,--domain DOMAIN

The SSSD domain to use the password in. The default name is “default”.

-f,--file FILE

Read the config file specified by the positional parameter. Default: /etc/sssd/sssd.conf

## SEE ALSO
sssd(8), sssd.conf(5), sssd-ldap(5), sssd-ldap-attributes(5), sssd-krb5(5), sssd-simple(5), sssd-ipa(5), sssd-ad(5), sssd-idp(5), sssd-sudo(5), sssd-session-recording(5), sss_cache(8), sss_debuglevel(8), sss_obfuscate(8), sss_seed(8), sssd_krb5_locator_plugin(8), sss_ssh_authorizedkeys(1), sss_ssh_knownhosts(1), sssd-ifp(5), pam_sss(8). sss_rpcidmapd(5)

## AUTHORS
The SSSD upstream - https://github.com/SSSD/sssd/