package: fence-agents-vmware-rest

title: fence_vmware_rest(8)

text:
# fence_vmware_rest(8)

## NAME
fence_vmware_rest - Fence agent for VMware REST API

## DESCRIPTION
fence_vmware_rest is a Power Fencing agent which can be used with VMware API to fence virtual machines.

NOTE: If there's more than 1000 VMs there is a filter parameter to work around the API limit. See https://code.vmware.com/apis/62/vcenter-management#/VM%20/get_vcenter_vm for full list of filters.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: https://www.vmware.com

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-a, --ip=[ip]

IP address or hostname of fencing device This parameter is always required.

-u, --ipport=[port]

TCP/UDP port to use for connection with device (Default Value: 80)

-t, --notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-z, --ssl

Use SSL connection with verifying certificate

--ssl-insecure

Use SSL connection without verifying certificate

--ssl-secure

Use SSL connection with verifying certificate

-l, --username=[name]

Login name This parameter is always required.

--api-path=[path]

The path part of the API URL (Default Value: /rest)

--filter=[filter]

Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 5)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 1)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

--gnutlscli-path=[path]

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

ip

IP address or hostname of fencing device This parameter is always required. Obsoletes: ipaddr

ipport

TCP/UDP port to use for connection with device (Default Value: 80)

notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

ssl

Use SSL connection with verifying certificate

ssl_insecure

Use SSL connection without verifying certificate

ssl_secure

Use SSL connection with verifying certificate

username

Login name This parameter is always required. Obsoletes: login

api_path

The path part of the API URL (Default Value: /rest)

filter

Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 5)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 1)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)

gnutlscli_path

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)


package: fence-agents-vmware-soap

title: fence_vmware_soap(8)

text:
# fence_vmware_soap(8)

## NAME
fence_vmware_soap - Fence agent for VMWare over SOAP API

## DESCRIPTION
fence_vmware_soap is a Power Fencing agent which can be used with the virtual machines managed by VMWare products that have SOAP API v4.1+.

Name of virtual machine (-n / port) has to be used in inventory path format (e.g. /datacenter/vm/Discovered virtual machine/myMachine). In the cases when name of yours VM is unique you can use it instead. Alternatively you can always use UUID to access virtual machine.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: http://www.vmware.com

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-a, --ip=[ip]

IP address or hostname of fencing device This parameter is always required.

-u, --ipport=[port]

TCP/UDP port to use for connection with device (Default Value: 80)

-t, --notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-z, --ssl

Use SSL connection with verifying certificate

--ssl-insecure

Use SSL connection without verifying certificate

--ssl-secure

Use SSL connection with verifying certificate

-l, --username=[name]

Login name This parameter is always required.

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 5)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 0)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

--gnutlscli-path=[path]

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

ip

IP address or hostname of fencing device This parameter is always required. Obsoletes: ipaddr

ipport

TCP/UDP port to use for connection with device (Default Value: 80)

notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

ssl

Use SSL connection with verifying certificate

ssl_insecure

Use SSL connection without verifying certificate

ssl_secure

Use SSL connection with verifying certificate

username

Login name This parameter is always required. Obsoletes: login

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 5)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 0)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)

gnutlscli_path

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)

branch: sisyphus


package: fence-agents-vmware-vcloud

title: fence_vmware_vcloud(8)

text:
# fence_vmware_vcloud(8)

## NAME
fence_vmware_vcloud - Fence agent for VMware vCloud Director API

## DESCRIPTION
fence_vmware_vcloud is a Power Fencing agent which can be used with VMware vCloud Director API to fence virtual machines.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: https://www.vmware.com

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-a, --ip=[ip]

IP address or hostname of fencing device This parameter is always required.

-u, --ipport=[port]

TCP/UDP port to use for connection with device (Default Value: 80)

-t, --notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-z, --ssl

Use SSL connection with verifying certificate

--ssl-insecure

Use SSL connection without verifying certificate

--ssl-secure

Use SSL connection with verifying certificate

-l, --username=[name]

Login name This parameter is always required.

--api-path=[path]

The path part of the API URL (Default Value: /api)

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 5)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 1)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

--gnutlscli-path=[path]

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

ip

IP address or hostname of fencing device This parameter is always required. Obsoletes: ipaddr

ipport

TCP/UDP port to use for connection with device (Default Value: 80)

notls

Disable TLS negotiation and force SSL3.0. This should only be used for devices that do not support TLS1.0 and up.

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

ssl

Use SSL connection with verifying certificate

ssl_insecure

Use SSL connection without verifying certificate

ssl_secure

Use SSL connection with verifying certificate

username

Login name This parameter is always required. Obsoletes: login

api_path

The path part of the API URL (Default Value: /api)

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 5)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 1)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)

gnutlscli_path

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)


package: fence-agents-wti

title: fence_wti(8)

text:
# fence_wti(8)

## NAME
fence_wti - Fence agent for WTI

## DESCRIPTION
fence_wti is a Power Fencing agent which can be used with the WTI Network Power Switch (NPS). It logs into an NPS via telnet or ssh and boots a specified plug. Lengthy telnet connections to the NPS should be avoided while a GFS cluster is running because the connection will block any necessary fencing actions.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: http://www.wti.com

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-c, --command-prompt=[prompt]

Force Python regex for command prompt (Default Value: ['RSM>', 'MPC>', 'IPS>', 'TPS>', 'NBB>', 'NPS>', 'VMR>'])

-k, --identity-file=[filename]

Identity file (private key) for SSH

-4, --inet4-only

Forces agent to use IPv4 addresses only

-6, --inet6-only

Forces agent to use IPv6 addresses only

-a, --ip=[ip]

IP address or hostname of fencing device This parameter is always required.

-u, --ipport=[port]

TCP/UDP port to use for connection with device (Default Value: 23)

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-x, --ssh

Use SSH connection

--ssh-options=[options]

SSH options to use

-l, --username=[name]

Login name

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 10)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 0)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

--ssh-path=[path]

Path to ssh binary (Default Value: /usr/bin/ssh)

--telnet-path=[path]

Path to telnet binary (Default Value: /usr/bin/telnet)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

command_prompt

Force Python regex for command prompt (Default Value: ['RSM>', 'MPC>', 'IPS>', 'TPS>', 'NBB>', 'NPS>', 'VMR>']) Obsoletes: cmd_prompt

identity_file

Identity file (private key) for SSH

inet4_only

Forces agent to use IPv4 addresses only

inet6_only

Forces agent to use IPv6 addresses only

ip

IP address or hostname of fencing device This parameter is always required. Obsoletes: ipaddr

ipport

TCP/UDP port to use for connection with device (Default Value: 23)

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

ssh

Use SSH connection Obsoletes: secure

ssh_options

SSH options to use

username

Login name Obsoletes: login

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 10)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 0)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)

ssh_path

Path to ssh binary (Default Value: /usr/bin/ssh)

telnet_path

Path to telnet binary (Default Value: /usr/bin/telnet)


package: fence-agents-xenapi

title: fence_xenapi(8)

text:
# fence_xenapi(8)

## NAME
fence_xenapi - Fence agent for Citrix XenServer over XenAPI

## DESCRIPTION
fence_xenapi is a Power Fencing agent used on Citrix XenServer hosts. It uses the XenAPI, supplied by Citrix, to establish an XML-RPC session to a XenServer host. Once the session is established, further XML-RPC commands are issued in order to switch on, switch off, restart and query the status of virtual machines running on the host.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: http://www.xenproject.org

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-s, --session-url

URL to connect to XenServer on This parameter is always required.

-l, --username=[name]

Login name

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 5)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 0)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

session_url

URL to connect to XenServer on This parameter is always required.

username

Login name Obsoletes: login

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 5)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 0)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 3)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)


package: fence-agents-zvm

title: fence_zvmip(8)

text:
# fence_zvmip(8)

## NAME
fence_zvmip - Fence agent for use with z/VM Virtual Machines

## DESCRIPTION
fence_zvmip is a Power Fencing agent for z/VM SMAPI service via TCP/IP.

The z/VM SMAPI service must be configured so that the virtual machine running the agent can connect to the service, access the system's directory manager, and shortly thereafter run image_deactivate and image_activate. This involves updating the VSMWORK1 NAMELIST and VSMWORK1 AUTHLIST VMSYS:VSMWORK1 files.

The NAMELIST entry assigns all the required functions to one nick and should look similar to this:

:nick.ZVM_FENCE

:list.

IMAGE_ACTIVATE

IMAGE_DEACTIVATE

IMAGE_STATUS_QUERY

CHECK_AUTHENTICATION

IMAGE_NAME_QUERY_DM

The AUTHLIST entry authorizes the user to perform all the functions associated with the nick, and should look similar to this:

Column 1 Column 66 Column 131

| | |

V V V

XXXXXXXX ALL ZVM_FENCE

where XXXXXXXX is the name of the user in the authuser field of the request.

Refer to the official z/VM documentation for complete instructions and reference materials.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: http://www.ibm.com

## PARAMETERS

-o, --action=[action]

Fencing action (Default Value: reboot)

-4, --inet4-only

Forces agent to use IPv4 addresses only

-6, --inet6-only

Forces agent to use IPv6 addresses only

-a, --ip=[ip]

IP address or hostname of fencing device This parameter is always required.

-u, --ipport=[port]

TCP/UDP port to use for connection with device (Default Value: 44444)

-m, --method=[method]

Method to fence (onoff|cycle) (Default Value: onoff)

-p, --password=[password]

Login password or passphrase

-S, --password-script=[script]

Script to run to retrieve password

-n, --plug=[id]

Physical plug number on device, UUID or identification of machine This parameter is always required.

-z, --ssl

Use SSL connection with verifying certificate (Default) (Default Value: 1)

--ssl-insecure

Use SSL connection without verifying certificate

--ssl-secure

Use SSL connection with verifying certificate

-l, --username=[name]

Login name This parameter is always required.

--disable-ssl

Don't use SSL

-q, --quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

-v, --verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

--verbose-level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

-D, --debug-file=[debugfile]

Write debug information to given file

-V, --version

Display version information and exit

-h, --help

Display help and exit

--plug-separator=[char]

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

-C, --separator=[char]

Separator for CSV created by 'list' operation (Default Value: ,)

--delay=[seconds]

Wait X seconds before fencing is started (Default Value: 0)

--disable-timeout=[true/false]

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

--login-timeout=[seconds]

Wait X seconds for cmd prompt after login (Default Value: 5)

--missing-as-off

Missing port returns OFF instead of failure (Default Value: 1)

--power-timeout=[seconds]

Test X seconds for status change after ON/OFF (Default Value: 20)

--power-wait=[seconds]

Wait X seconds after issuing ON/OFF (Default Value: 0)

--shell-timeout=[seconds]

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

--stonith-status-sleep=[seconds]

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

--retry-on=[attempts]

Count of attempts to retry power on (Default Value: 1)

--gnutlscli-path=[path]

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)

## ACTIONS

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

status

This returns the status of the plug/virtual machine.

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

monitor

Check the health of fence device

metadata

Display the XML metadata describing this resource.

manpage

The operational behavior of this is not known.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

action

Fencing action (Default Value: reboot)

inet4_only

Forces agent to use IPv4 addresses only

inet6_only

Forces agent to use IPv6 addresses only

ip

IP address or hostname of fencing device This parameter is always required. Obsoletes: ipaddr

ipport

TCP/UDP port to use for connection with device (Default Value: 44444)

method

Method to fence (onoff|cycle) (Default Value: onoff)

password

Login password or passphrase Obsoletes: passwd

password_script

Script to run to retrieve password Obsoletes: passwd_script

plug

Physical plug number on device, UUID or identification of machine This parameter is always required. Obsoletes: port

ssl

Use SSL connection with verifying certificate (Default) (Default Value: 1)

ssl_insecure

Use SSL connection without verifying certificate

ssl_secure

Use SSL connection with verifying certificate

username

Login name This parameter is always required. Obsoletes: login

disable_ssl

Don't use SSL

quiet

Disable logging to stderr. Does not affect --verbose or --debug-file or logging to syslog.

verbose

Verbose mode. Multiple -v flags can be stacked on the command line (e.g., -vvv) to increase verbosity.

verbose_level

Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).

debug_file

Write debug information to given file Obsoletes: debug

version

Display version information and exit

help

Display help and exit

plug_separator

Separator for plug parameter when specifying more than 1 plug (Default Value: ,)

separator

Separator for CSV created by 'list' operation (Default Value: ,)

delay

Wait X seconds before fencing is started (Default Value: 0)

disable_timeout

Disable timeout (true/false) (default: true when run from Pacemaker 2.0+)

login_timeout

Wait X seconds for cmd prompt after login (Default Value: 5)

missing_as_off

Missing port returns OFF instead of failure (Default Value: 1)

power_timeout

Test X seconds for status change after ON/OFF (Default Value: 20)

power_wait

Wait X seconds after issuing ON/OFF (Default Value: 0)

shell_timeout

Wait X seconds for cmd prompt after issuing command (Default Value: 5)

stonith_status_sleep

Sleep X seconds between status calls during a STONITH action (Default Value: 1)

retry_on

Count of attempts to retry power on (Default Value: 1)

gnutlscli_path

Path to gnutls-cli binary (Default Value: /usr/bin/gnutls-cli)


package: fence-sanlock

title: fence_sanlock(8)

text:
# fence_sanlock(8)

## NAME
fence_sanlock - fence agent using watchdog and shared storage leases

## SYNOPSIS
fence_sanlock [OPTIONS]

## DESCRIPTION
fence_sanlock uses the watchdog device to reset nodes, in conjunction with three daemons: fence_sanlockd, sanlock, and wdmd.

The watchdog device, controlled through /dev/watchdog, is available when a watchdog kernel module is loaded. A module should be loaded for the available hardware. If no hardware watchdog is available, or no module is loaded, the "softdog" module will be loaded, which emulates a hardware watchdog device.

Shared storage must be configured for sanlock to use from all hosts. This is generally an lvm lv (non-clustered), but could be another block device, or NFS file. The storage should be 1GB of fully allocated space. After being created, the storage must be initialized with the command:

\# fence_sanlock -o sanlock_init -p /path/to/storage

The fence_sanlock agent uses sanlock leases on shared storage to verify that hosts have been reset, and to notify fenced nodes that are still running, that they should be reset.

The fence_sanlockd init script starts the wdmd, sanlock and fence_sanlockd daemons before the cluster or fencing systems are started (e.g. cman, corosync and fenced). The fence_sanlockd daemon is started with the -w option so it waits for the path and host_id options to be provided when they are available.

Unfencing must be configured for fence_sanlock in cluster.conf. The cman init script does unfencing by running fence_node -U, which in turn runs fence_sanlock with the "on" action and local path and host_id values taken from cluster.conf. fence_sanlock in turn passes the path and host_id values to the waiting fence_sanlockd daemon. With these values, fence_sanlockd joins the sanlock lockspace and acquires a resource lease for the local host. It can take several minutes to complete these unfencing steps.

Once unfencing is complete, the node is a member of the sanlock lockspace named "fence" and the node's fence_sanlockd process holds a resource lease named "hN", where N is the node's host_id. (To verify this, run the commands "sanlock client status" and "sanlock client host_status", which show state from the sanlock daemon, or "sanlock direct dump <path>" which shows state from shared storage.)

When fence_sanlock fences a node, it tries to acquire that node's resource lease. sanlock will not grant the lease until the owner (the node being fenced) has been reset by its watchdog device. The time it takes to acquire the lease is 140 seconds from the victim's last lockspace renewal timestamp on the shared storage. Once acquired, the victim's lease is released, and fencing completes successfully.

Live nodes being fenced

When a live node is being fenced, fence_sanlock will continually fail to acquire the victim's lease, because the victim continues to renew its lockspace membership on storage, and the fencing node sees it is alive. This is by design. As long as the victim is alive, it must continue to renew its lockspace membership on storage. The victim must not allow the remote fence_sanlock to acquire its lease and consider it fenced while it is still alive.

At the same time, a victim knows that when it is being fenced, it should be reset to avoid blocking recovery of the rest of the cluster. To communicate this, fence_sanlock makes a "request" on storage for the victim's resource lease. On the victim, fence_sanlockd, which holds the resource lease, is configured to receive SIGUSR1 from sanlock if anyone requests its lease. Upon receiving the signal, fence_sanlockd knows that it is a fencing victim. In response to this, fence_sanlockd allows its wdmd connection to expire, which in turn causes the watchdog device to fire, resetting the node.

The watchdog reset will obviously have the effect of stopping the victim's lockspace membership renewals. Once the renewals stop, fence_sanlock will finally be able to acquire the victim's lease after waiting a fixed time from the final lockspace renewal.

Loss of shared storage

If access to shared storage with sanlock leases is lost for 80 seconds, sanlock is not able to renew the lockspace membership, and enters recovery. This causes sanlock clients holding leases, such as fence_sanlockd, to be notified that their leases are being lost. In response, fence_sanlockd must reset the node, much as if it was being fenced.

Daemons killed/crashed/hung

If sanlock, fence_sanlockd daemons are killed abnormally, or crash or hang, their wdmd connections will expire, causing the watchdog device to fire, resetting the node. fence_sanlock from another node will then run and acquire the victim's resource lease. If the wdmd daemon is killed abnormally or crashes or hangs, it will not pet the watchdog device, causing it to fire and reset the node.

Time Values

The specific times periods referenced above, e.g. 140, 80, are based on the default sanlock i/o timeout of 10 seconds. If sanlock is configured to use a different i/o timeout, these numbers will be different.

## OPTIONS
-o action

The agent action:

on

Enable the local node to be fenced. Used by unfencing.

off

Disable another node.

status

Test if a node is on or off. A node is on if it's lease is held, and off is it's lease is free.

metadata

Print xml description of required parameters.

sanlock_init

Initialize sanlock leases on shared storage.

-p path

The path to shared storage with sanlock leases.

-i host_id

The host_id, from 1-128.

## STDIN PARAMETERS
Options can be passed on stdin, with the format key=val. Each key=val pair is separated by a new line.

action=on|off|status

See -o

path=/path/to/shared/storage

See -p

host_id=num

See -i

## FILES
Example cluster.conf configuration for fence_sanlock.

(For cman based clusters in which fenced runs agents.)

Also see cluster.conf(5), fenced(8), fence_node(8).

```
<clusternode name="node01" nodeid="1">

        <fence>

        <method name="1">

        <device name="wd" host_id="1"/>

        </method>

        </fence>

        <unfence>

        <device name="wd" host_id="1" action="on"/>

        </unfence>
</clusternode>
<clusternode name="node02" nodeid="2">

        <fence>

        <method name="1">

        <device name="wd" host_id="2"/>

        </method>

        </fence>

        <unfence>

        <device name="wd" host_id="2" action="on"/>

        </unfence>
</clusternode>
<fencedevice name="wd" agent="fence_sanlock" path="/dev/fence/leases"/>
```

Example dlm.conf configuration for fence_sanlock.

(For non-cman based clusters in which dlm_controld runs agents.)

Also see dlm.conf(5), dlm_controld(8).

```
device wd /usr/sbin/fence_sanlock path=/dev/fence/leases
connect wd node=1 host_id=1
connect wd node=2 host_id=2
unfence wd
```

## TEST
To test fence_sanlock directly, without clustering:

```
1. Initialize storage
node1: create 1G lv on shared storage /dev/fence/leases
node1: fence_sanlock -o sanlock_init -p /dev/fence/leases
2. Start services
node1: service fence_sanlockd start
node2: service fence_sanlockd start
3. Enable fencing
node1: fence_sanlock -o on -p /dev/fence/leases -i 1
node2: fence_sanlock -o on -p /dev/fence/leases -i 2
This "unfence" step may take a couple minutes.
4. Verify hosts and leases
node1: sanlock status
s fence:1:/dev/fence/leases:0
r fence:h1:/dev/fence/leases:1048576:1 p 2465
node2: sanlock status
s fence:2:/dev/fence/leases:0
r fence:h2:/dev/fence/leases:2097152:1 p 2366
node1: sanlock host_status
lockspace fence
1 timestamp 717
2 timestamp 678
node2: sanlock host_status
lockspace fence
1 timestamp 738
2 timestamp 678
5. Fence node2
node1: fence_sanlock -o off -p /dev/fence/leases -i 2
This may take a few minutes to return.
When node2 is not dead before fencing, sanlock on node1 will log errors
about failing to acquire the lease while node2 is still alive.  This is
expected.
6. Success
node1 fence_sanlock should exit 0 after node2 is reset by its watchdog.
```

## SEE ALSO
fence_sanlockd(8), sanlock(8), wdmd(8)


title: fence_sanlockd(8)

summary: daemon for fence_sanlock agent

text:
# fence_sanlockd(8)

## NAME
fence_sanlockd - daemon for fence_sanlock agent

## SYNOPSIS
fence_sanlockd [OPTIONS]

## DESCRIPTION
The fence_sanlockd daemon is used by the fence_sanlock agent. See fence_sanlock(8), for full description.

## OPTIONS
-D

Enable debugging to stderr and don't fork.

-p path

Path to shared storage with sanlock leases.

-i host_id

Local sanlock host_id (1-128).

-w

Wait for fence_sanlockd -s to send options (p,i).

-s

Send options (p,i) to waiting fence_sanlockd -w.

-1

Send SIGUSR1 to running fence_sanlockd.

## SEE ALSO
fence_sanlock(8), sanlock(8), wdmd(8), fence_node(8), fenced(8)


package: fence-virt

title: fence_virt(8)

text:
# fence_virt(8)

## NAME
fence_virt - Fence agent for virtual machines

## DESCRIPTION
fence_virt is a Power Fencing agent which can be used with virtual machines.

NOTE: reboot-action does not power on nodes that are powered off.

The fence agent accepts options on the command line as well as from stdin. Fenced sends parameters through stdin when it execs the agent. The agent can be run by itself with command line options. This is useful for testing and for turning outlets on or off from scripts.

Vendor URL: https://libvirt.org

## PARAMETERS

-d

Specify (stdin) or increment (command line) debug level

-D

Serial device (default=/dev/ttyS1) (Default Value: /dev/ttyS1)

-P

Serial Parameters (default=115200,8N1) (Default Value: 115200,8N1)

-A

VM Channel IP address (default=10.0.2.179) (Default Value: 10.0.2.179)

-p

TCP, Multicast, VMChannel, or VM socket port (default=1229) (Default Value: 1229)

-n

Virtual Machine (domain name) to fence This parameter is always required.

-o

Fencing action (null, off, on, [reboot], status, list, list-status, monitor, validate-all, metadata) (Default Value: reboot)

-t

Fencing timeout (in seconds; default=30) (Default Value: 30)

-T

IP address to connect to in TCP mode (default=127.0.0.1 / ::1) (Default Value: 127.0.0.1)

-S

vm socket CID to connect to in vsock mode (Default Value: 2)

-C

Authentication (none, sha1, [sha256], sha512) (Default Value: sha256)

-c

Packet hash strength (none, sha1, [sha256], sha512) (Default Value: sha256)

-k

Shared key file (default=/etc/cluster/fence_xvm.key) (Default Value: /etc/cluster/fence_xvm.key)

-w

Fencing delay (in seconds; default=0) (Default Value: 0)

## ACTIONS

null

The operational behavior of this is not known.

on

Power on machine.

off

Power off machine.

reboot

Reboot machine.

metadata

Display the XML metadata describing this resource.

status

This returns the status of the plug/virtual machine.

monitor

Check the health of fence device

list

List available plugs with aliases/virtual machines if there is support for more then one device. Returns N/A otherwise.

list-status

List available plugs with aliases/virtual machines and their power state if it can be obtained without additional commands.

validate-all

Validate if all required parameters are entered.

## STDIN PARAMETERS

debug

Specify (stdin) or increment (command line) debug level

serial_device

Serial device (default=/dev/ttyS1) (Default Value: /dev/ttyS1)

serial_params

Serial Parameters (default=115200,8N1) (Default Value: 115200,8N1)

channel_address

VM Channel IP address (default=10.0.2.179) (Default Value: 10.0.2.179)

ipport

TCP, Multicast, VMChannel, or VM socket port (default=1229) (Default Value: 1229)

plug

Virtual Machine (domain name) to fence This parameter is always required. Obsoletes: port

action

Fencing action (null, off, on, [reboot], status, list, list-status, monitor, validate-all, metadata) (Default Value: reboot)

timeout

Fencing timeout (in seconds; default=30) (Default Value: 30)

ipaddr

IP address to connect to in TCP mode (default=127.0.0.1 / ::1) (Default Value: 127.0.0.1)

vsock

vm socket CID to connect to in vsock mode (Default Value: 2)

auth

Authentication (none, sha1, [sha256], sha512) (Default Value: sha256)

hash

Packet hash strength (none, sha1, [sha256], sha512) (Default Value: sha256)

key_file

Shared key file (default=/etc/cluster/fence_xvm.key) (Default Value: /etc/cluster/fence_xvm.key)

delay

Fencing delay (in seconds; default=0) (Default Value: 0)


package: fence-virtd

title: fence_virtd(8)

text:
# fence_virtd(8)

## NAME
fence_virtd - Fencing host for virtual machines

## DESCRIPTION
fence_virtd is a host daemon designed to route fencing requests for virtual machines.

Fence_virt and fence_xvm talk to fence_virtd, which supports multiple backend plugins, including:

- libvirt for single-node operation

- Corosync CPG and libvirt when using Linux-cluster release 3.0.0 or later

- libvirt-qpid for multi-node, non-cluster operation

For compatibility, fence_xvm from linux-cluster release 2 may talk to fence_virtd.

fence_virtd accepts a few options on the command line, but most options are read from fence_virt.conf.

## PARAMETERS
-d

Specify debug level, e.g. "-d99"

-c

Interactively prompt user for configuration information

-f

Specify an alternate configuration file instead of /etc/fence_virt.conf

-F

Do not fork into background after starting (overrides any setting in fence_virt.conf)

-w

Wait for backend to be available (overrides any setting in fence_virt.conf)

-p

Specify the full path to the pid file used to record the active process pid.

## SEE ALSO
fence_virt(8), fence_xvm(8), fence(8), fence_virt.conf(5)


fiaif

package: fiaif

title: fiaif(8)

summary: FIAIF is an Intelligent Firewall.

text:
# fiaif(8)

## NAME
fiaif - FIAIF is an Intelligent Firewall.

## SYNOPSIS
fiaif <start|stop|restart|force-reload|status|panic|tc-start|tc-stop|tc-status>

## DESCRIPTION
Fiaif deploys a packet-filtering firewall by reading configuration files and setting up IP packet filtering rules using iptables. The firewall is "zone" based, meaning that each network interface is associated with a defined piece of the "IP universe" on the other side of that interface from the host. A zone is defined in a text file (the zone configuration file) listing rules for the handling of IP traffic into, out of, and through the associated interface. The rules spell out which connections to accept, which to reject, which to ignore, and which to forward through the firewall. It is also possible to setup source and destination NAT for altering the source and/or destination addresses of packets as they pass through. All non-accepted packets are logged to the system log.

It should be noted that any packet related to an already accepted connection is allowed though the firewall.

## OPTIONS
start

This will save the current state of netfilter, and apply the new firewall as described in the configuration files.

stop

Restores the state saved when FIAIF was started.

restart

Same as stop,start

force-reload

This option is the same as start, although it does not use any previously saved rules, and can be used even if fiaif has already been started.

start-tc

Start/restart only traffic shaping. Useful if you are playing arround with that part of the fiaf subsystem.

panic

Shut off all IP traffic - don't accept any packets from anywhere for any reason. This can be used, for example, if uninvited guests are discovered on the system to quickly close the firewall and start analyzing log files.

status

Lists all rules in the firewall.

test

Instead of deploying the firewall, all rules are written to the file specified in the "TEST_FILE" parameter in the global configuration file. This command also runs a sanity check on the networking configuration. Any problems or warnings arising from this check are printed to STDERR. Refer to http://www.linuxhq.com/kernel/v2.4/doc/networking/ip-sysctl.txt.html for details on settings tested. When deployed, FIAIF can automatically fix the warnings and/or errors displayed. Please see fiaif.conf(8) for more information.

tc-start

Start only traffic shaping. This option ignores the "ENABLE_TC" parameter in the global configuration file.

tc-stop

Stops the traffic shaping. This option ignores the "ENABLE_TC" parameter in the global configuration file.

tc-status

Lists packet counters for all traffic classes.

## FILES
/etc/fiaif/fiaif.conf

The global configuration file. See fiaif.conf(8) for further details.

/var/lib/fiaif/fiaif

file containing rules generated by fiaif.

/var/lib/fiaif/iptables previous netfilter state

/var/lib/fiaif/sysctl

previous state of /proc before fiaif was started.

/var/log/messages

All illegal packets are logged to this file though syslog(3)

## DIAGNOSTICS
Errors are logged to STDOUT. If any errors is printed, then please recheck your configuration files.

## ENVIRONMENT
If the NO_CLEANUP variable is set to a non-empty value, then rules are not cleaned up after FIAIF is started. This will speed up FIAIF startup time, but at the cost of having lots of rules and performance may (on small systems with many zones) be affected. On a three zone system FIAIF generated in total 310 rules. After cleaning up the rules, the number of rules was down to 241. A reduction of 22%.

The FIAIF_CONF can be used to specify an anternative global configurationfile, rather than using the default /etc/fiaif/fiaif.conf. This can be used to ease switching between two different firewall configurations.

## BUGS
The test command line option is no guarantee that the firewall will perform as expected, only that the syntax is correct. Only limited semantic checks of rulesis performed.

## REPORTING BUGS
Report bugs to <fiaif@fiaif.net>.

## AUTHOR
Anders Fugmann <anders(at)fugmann.net>

## SEE ALSO
fiaif.conf(8), zone.conf(8), iptables(8), syslog(3)


fiaif-getdev

title: fiaif-getdev(8)

text:
# fiaif-getdev(8)

## NAME
fiaif-getdev - retreive interface data and print information to standard out.

## SYNOPSIS
fiaif-getdev <interface>

## DESCRIPTION
Prints out variables for the specified to be inserted into a zone configuration file. All interface aliases (e.g eth1:1) are also read and data appended to IP_EXTRA and NET_EXTRA. If this is undesirable, leave the two parameters empty when editing the zone configuration file.

## EXIT CODE
0 on success, 1 othervice.

## REPORTING BUGS
Report bugs to <fiaif@fiaif.net>.

## AUTHOR
Anders Fugmann <anders(at)fugmann.net>

## SEE ALSO
fiaif(8), zone.conf(5)


fiaif-scan

title: fiaif-scan(8)

text:
# fiaif-scan(8)

## NAME
fiaif-scan - print syslog entries in human readable form

## SYNOPSIS
fiaif-scan [ -n ] [ -m ]

## DESCRIPTION
fiaif-scan reads lines from STDIN and prints to STDOUT, in human readable form, any packets found (standard syslog format is assumed). Each log message is parsed based on the configuration files at the time fiaf-scan is run. The idea is to enable the user to quickly identify which zone rule is causing the packet to be logged, and how to change this, if necessary.

## OPTIONS
-n

Don´t do a reverse lookup of IP addresses or ports; display them as numbers. This reduces the number of host lookups and speeds up scanning.

-m

print the MAC address on each line.

## EXAMPLE
fiaf-scan -n </var/log/messages

Scan from the current system log and display any packets on the console. Don´t look up names for IP addressses or ports; just show the numbers.

## FILES
/etc/fiaif/fiaif.conf

## AUTHOR
Anders Fugmann <anders(at)fugmann.net>

## BUGS
The program has been tested only with messages from the standard syslog. It may work on lines from ulogd, but this has not been tested.

Bash may not be the fastest parser in the world. Expect this software to be slow. (40 lines per sec on a K6-II/300Mhz without name lookups).

Please report other bugs to <fiaif@fiaif.net>.

## SEE ALSO
fiaif.conf(5), zone.conf(5), iptables(8), syslog(3)


fiaif-update

title: fiaif-update(8)

text:
# fiaif-update(8)

## NAME
fiaif-update - tests for new version and updated reserved_networks file.

## SYNOPSIS
fiaif-update [--silent] [--help] <update|check>

## DESCRIPTION
Tests for new version and updated reserved_networks file.

--silent

If this flag is present, then no textual output will be given.

check

Test if a new version of FIAIF is available.

update

Retrieves the files reserved_networks from the FIAIF website, and compared the version with the currently installed version, as pointed to by fiaif.conf. If the retrieved version is newer, the old version is silently replaced.

help

Prints the synopsis.

## EXIT CODE
If updating the exit code will be non-zero if no update was performed, else the exit code will be zero.

## FILES
/etc/fiaif/fiaif.conf

The configuration file for FIAIF

/etc/fiaif/private_networks A list of private networks as specified by RFC1918

/etc/fiaif/reserved_networks A list of reserved networks as specified by IANA.

## REPORTING BUGS
Report bugs to <fiaif@fiaif.net>.

## AUTHOR
Anders Fugmann <anders(at)fugmann.net>

## SEE ALSO
fiaif(8), fiaif.conf(5)


in.fingerd

package: finger-server

title: in.fingerd(8)

summary: remote user information server

text:
# in.fingerd(8)

## NAME
in.fingerd — remote user information server

## SYNOPSIS
in.fingerd

[-lMmpSsu] [-P filename]

## DESCRIPTION
in.fingerd is a simple protocol based on RFC 1288 that provides an interface to the Name and Finger programs at several network sites. The program is supposed to return a friendly, human-oriented status report on either the system at the moment or a particular person in depth. There is no required format and the protocol consists mostly of specifying a single “command line”.

in.fingerd is started by inetd(8), which listens for TCP requests at port 79. Once connected it reads a single command line terminated by a ⟨CRLF⟩ which is passed to finger(1). in.fingerd closes its connections as soon as the output is finished.

If the line is null (i.e., just a ⟨CRLF⟩ is sent) then finger(1) returns a “default” report that lists all people logged into the system at that moment.

If a user name is specified (e.g., eric⟨CRLF⟩) then the response lists more extended information for only that particular user, whether logged in or not. Allowable “names” in the command line include both “login names” and “user names”. If a name is ambiguous, all possible derivations are returned.

The following options may be passed to in.fingerd as server program arguments in /etc/inetd.conf:

-l

Enable logging. The name of the host originating the query and the actual request is reported via syslog(3) at LOG_NOTICE priority. A request of the form ‘/W’ or ‘/w’ will return long output. Empty requests will return all currently logged in users. All other requests look for specific users. See RFC 1288 for details.

-M

Enables matching of user names. This is disabled by default if the system is running YP.

-m

Prevent matching of user names. User is usually a login name; however, matching will also be done on the users' real names, unless the -m option is supplied.

-P filename

Use an alternate program as the local information provider. The default local program executed by in.fingerd is finger(1). By specifying a customized local server, this option allows a system manager to have more control over what information is provided to remote sites.

-p

Prevents finger(1) from displaying the contents of the “.plan” and “.project” files.

-S

Prints user information in short mode, one line per user. This overrides the “Whois switch” that may be passed in from the remote client.

-s

Enable secure mode. Forwarding of queries to other remote hosts is denied.

-u

Queries without a user name are rejected.

## SEE ALSO
finger(1), inetd(8), xinetd(8)

## HISTORY
The in.fingerd command appeared in 4.3BSD.

## BUGS
Connecting directly to the server from a TIP or an equally narrow-minded TELNET-protocol user program can result in meaningless attempts at option negotiation being sent to the server, which will foul up the command line interpretation. in.fingerd should be taught to filter out IAC's and perhaps even respond negatively (IAC WON'T) to all option commands received.


fixparts

package: fixparts

title: fixparts(8)

summary: MBR partition table repair utility

text:
# fixparts(8)

## NAME
fixparts - MBR partition table repair utility

## SYNOPSIS
fixparts device

## DESCRIPTION
FixParts (aka fixparts) is a text-mode menu-driven program for repairing certain types of problems with Master Boot Record (MBR) partition tables. The program has three design goals, although a few additional features are supported, as well:

*

It can remove stray GUID Partition Table (GPT) data, which can be left behind on a disk that was once used as a GPT disk but then incompletely converted to the more common (as of 2011) MBR form.

*

It can repair mis-sized extended partitions -- either partitions that extend beyond the physical end of the disk or that overlap with nearby primary partitions. FixParts is designed in such a way that this type of repair occurs automatically, so if it's the only problem with your disk, you can launch the program and then immediately save the partition table, making no manual changes, and the program will fix the problem.

*

You can change primary partitions into logical partitions or vice-versa, within constraints imposed by the MBR data structures.

Additional features include the ability to change partition type codes or boot/active flags, to delete partitions, and to recompute CHS values. With the possible exception of recomputing CHS values, these secondary features are better performed with fdisk, because fixparts' design means that it's likely to alter partition numbering even when such changes are not requested.

The fixparts program employs a user interface similar to that of Linux's fdisk, but fixparts is much more specialized. Most importantly, you can't create new partitions with fixparts, although you can change primary/logical assignment.

In the MBR scheme, partitions come in three varieties:

primary

These partitions are defined in the first sector of the hard disk and are limited in number to four. Some OSes, such as Windows and FreeBSD, must boot from a primary partition.

extended

Extended partitions are specialized primary partitions. They serve as holding areas for logical partitions.

logical

A disk can contain an arbitrary number of logical partitions (fixparts, however, imposes a limit of 124 logical partitions). All the logical partitions reside inside a single extended partition, and are defined using a linked-list data structure. This fact means that every logical partition must be preceded by at least one sector of unallocated space to hold its defining data structure (an Extended Boot Record, or EBR).

These distinctions mean that primary and logical partitions cannot be arbitrarily interspersed. A disk can contain one to three primary partitions, a block of one or more logical partitions, and one to three more primary partitions (for a total of three primary partitions, not counting the extended partition). Primary partitions may not be sandwiched between logical partitions, since this would mean placing a primary partition within an extended partition (which is just a specific type of primary partition).

Unlike most disk utilities, fixparts' user interface ignores extended partitions. Internally, the program discards the information on the original extended partition and, when you tell it to save its changes, it generates a new extended partition to contain the then-defined logical partitions. This is done because most of the repairs and manipulations the tool performs require generating a fresh extended partition, so keeping the original in the user interface would only be a complication.

Another unusual feature of fixparts' user interface is that partition numbers do not necessarily correlate with primary/logical status. In most utilities, partitions 1-4 correspond to primary partitions, whereas partitions 5 and up are logical partitions. In fixparts, any partition number may be assigned primary or logical status, so long as the rules for layout described earlier are obeyed. When the partition table is saved, partitions will be assigned appropriately and then tools such as the Linux kernel and fdisk will give them conventional numbers.

When it first starts, fixparts performs a scan for GPT data. If the disk looks like a conventional GPT disk, fixparts refuses to run. If the disk appears to be a conventional MBR disk but GPT signatures are present in the GPT primary or secondary header areas, fixparts offers to delete this extraneous data. If you tell it to do so, the program immediately wipes the GPT header or headers. (If only one header was found, only that one header will be erased, to minimize the risk of damaging a boot loader or other data that might have overwritten just one of the GPT headers.)

With the exception of optionally erasing leftover GPT data when it first starts, fixparts keeps all changes in memory until the user writes changes with the w command. Thus, you can adjust your partitions in the user interface and abort those changes by typing q to quit without saving changes.

## OPTIONS
The fixparts utility supports no command-line options, except for specification of the target device.

Most interactions with fixparts occur with its interactive text-mode menu. Specific functions are:

a

Toggle the active/boot flag. This flag is required by some boot loaders and OSes.

c

Recompute the cylinder/head/sector (CHS) values for all partitions. CHS addressing mode is largely obsolete, but some OSes and utilities complain if they don't like the CHS values. Note that fixparts' CHS values are likely to be incorrect on disks smaller than about 8 GiB except on Linux.

l

Change a partition's status to logical. This option will only work if the current partition layout supports such a change. Note that if changing a partition's status in this way is not currently possible, making some other change may make it possible. For instance, omitting a partition that precedes the target partition may enable converting a partition to logical form if there had been no free sectors between the two partitions.

o

Omit a partition. Once omitted, the partition will still appear in the fixparts partition list, but it will be flagged as omitted. You can subsequently convert it to primary or logical form with the r or l commands, respectively. When you save your changes with w, though, the partition will be lost.

p

Display basic partition summary data. This includes partition's number, the boot/active flag's status, starting and ending sector numbers, primary/logical/omitted status, whether or not the partition may be converted to logical form, and the partition's MBR types code.

q

Quit from the program without saving your changes. Use this option if you just wanted to view information or if you make a mistake and want to back out of all your changes.

r

Change a partition's status to primary. This option will only work if the current partition layout supports such a change. Note that every partition can theoretically become a primary partition, although in some configurations, making this change will require omitting some partitions. If fixparts refuses to allow changing a partition to primary, you may need to convert other partitions to logical form or omit them entirely.

s

Sort partition entries. This option orders partitions in the display to match their on-disk positions, which can make understanding the disk layout easier in some cases. This option has no effect on the ultimate ordering of logical partitions, which are sorted before being saved. The order of primary partitions in the final saved partition table may be affected by this option. In both cases, as already noted, the partition numbers displayed by fixparts may not be the same as those used by the kernel or displayed by other partitioning tools.

t

Change a partition's type code. You enter the type code using a one-byte hexadecimal number.

w

Write data. Use this command to save your changes and exit from the program.

?

Print the menu. Type this command (or any other unrecognized command) to see a summary of available options.

## BUGS
Known bugs and limitations include:

*

The program compiles correctly only on Linux, FreeBSD, Mac OS X, and Windows. Linux versions for x86-64 (64-bit), x86 (32-bit), and PowerPC (32-bit) have been tested, with the x86-64 version having seen the most testing. Under FreeBSD, 32-bit (x86) and 64-bit (x86-64) versions have been tested. Only 32-bit versions for Mac OS X and Windows have been tested.

*

The FreeBSD version of the program can't write changes to the partition table to a disk when existing partitions on that disk are mounted. (The same problem exists with many other FreeBSD utilities, such as gpt, fdisk, and dd.) This limitation can be overcome by typing sysctl kern.geom.debugflags=16 at a shell prompt.

*

The program can load only up to 128 partitions (4 primary partitions and 124 logical partitions). This limit can be raised by changing the #define MAX_MBR_PARTS line in the basicmbr.h source code file and recompiling.

*

The program can read partitions only if the disk has correct LBA partition descriptors. These descriptors should be present on any disk over 8 GiB in size or on smaller disks partitioned with any but very ancient software.

*

The program makes no effort to preserve partition numbers. This can have consequences for boot loaders and for mounting filesystems via /etc/fstab. It may be necessary to edit configuration files or even to re-install your boot loader.

*

The program may change the order of partitions in the partition table.

## AUTHORS
Primary author: Roderick W. Smith (rodsmith@rodsbooks.com)

Contributors:

* Yves Blusseau (1otnwmz02@sneakemail.com)

* David Hubbard (david.c.hubbard@gmail.com)

* Justin Maggard (justin.maggard@netgear.com)

* Dwight Schauer (das@teegra.net)

* Florian Zumbiehl (florz@florz.de)

## SEE ALSO
cfdisk(8), cgdisk(8), fdisk(8), mkfs(8), parted(8), sfdisk(8), gdisk(8), sgdisk(8).

https://en.wikipedia.org/wiki/Master_boot_record

https://www.rodsbooks.com/fixparts/

## AVAILABILITY
The fixparts command is part of the GPT fdisk package and is available from Rod Smith.