pppd-radius

title: pppd-radius(8)

summary: RADIUS authentication plugin for

text:
# pppd-radius(8)

## NAME
radius.so - RADIUS authentication plugin for pppd(8)

## SYNOPSIS
pppd [ options ] plugin radius.so

## DESCRIPTION
The RADIUS plugin for pppd permits pppd to perform PAP, CHAP, MS-CHAP and MS-CHAPv2 authentication against a RADIUS server instead of the usual /etc/ppp/pap-secrets and /etc/ppp/chap-secrets files.

The RADIUS plugin is built on a library called radiusclient which has its own configuration files (usually in /etc/ppp/radius), consult those files for more information on configuring the RADIUS plugin

## OPTIONS
The RADIUS plugin introduces one additional pppd option:

radius-config-file filename

The file filename is taken as the radiusclient configuration file. If this option is not used, then the plugin uses /etc/ppp/radius/radiusclient.conf as the configuration file.

avpair attribute=value

Adds an Attribute-Value pair to be passed on to the RADIUS server on each request.

map-to-ifname

Sets Radius NAS-Port attribute to number equal to interface name (Default)

map-to-ttyname

Sets Radius NAS-Port attribute value via libradiusclient library

## USAGE
To use the plugin, simply supply the plugin radius.so option to pppd, and edit /etc/ppp/radius/radiusclient.conf appropriately. If you use the RADIUS plugin, the normal pppd authentication schemes (login, checking the /etc/ppp/*-secrets files) are skipped. The RADIUS server should assign an IP address to the peer using the RADIUS Framed-IP-Address attribute.

## SEE ALSO
pppd(8) pppd-radattr(8)

## AUTHOR
Dianne Skoll <dianne@skoll.ca>


pptp

package: pptp-client

title: pptp(8)

summary: PPTP driver

text:
# pptp(8)

## NAME
pptp - PPTP driver

## SYNOPSIS
pptp <pptp-server-IP> <pptp-options> [ppp-options] ...

## DESCRIPTION
pptp establishes the client side of a Virtual Private Network (VPN) using the Point-to-Point Tunneling Protocol (PPTP). Use this program to connect to an employer's PPTP based VPN, or to certain cable and ADSL service providers.

By default, pptp establishes the PPTP call to the PPTP server, and then starts an instance of pppd to manage the data transfer. However, pptp can also be run as a connection manager within pppd.

## OPTIONS
The first non-option argument on the pptp command line must be the host name or IP address of the PPTP server.

All long options (starting with "--") are interpreted as pptp options, and a fatal error occurs if an unrecognised option is used.

All command-line arguments which do not start with "-" are interpreted as ppp options, and passed as is to pppd unless --nolaunchpppd is given.

--phone <number>

Pass <number> to remote host as phone number

--nolaunchpppd

Do not launch pppd but use stdin as the network connection. Use this flag when including pptp as a pppd connection process using the pty option. See EXAMPLES.

--quirks <quirk>

Work around a buggy PPTP implementation, adopts special case handling for particular PPTP servers and ADSL modems. Currently recognised values are BEZEQ_ISRAEL only

--debug

Run in foreground (for debugging with gdb)

--sync

Enable Synchronous HDLC (pppd must use it too)

--timeout <secs>

Time to wait for reordered packets (0.01 to 10 secs)

--nobuffer

Completely disables buffering and reordering of packets. Any --timeout specified will be ignored.

--idle-wait <secs>

Time to wait before sending a control connection echo request. The RFC2637 default is 60 seconds.

--max-echo-wait <secs>

Time to wait for an echo reply before closing the control connection. The RFC2637 default is 60 seconds.

--logstring <name>

Use <name> instead of 'anon' in syslog messages

--localbind <addr>

Bind to specified IP address instead of wildcard

--rtmark <n>

Use specified policy routing mark for all packets. This causes both the TCP control connection's packets as well as the GRE packets to bear the given policy routing / netfilter mark. This can be used with ip rule (from iproute2) to use a separate routing table for the pptp client. (requires root privileges or the CAP_NET_ADMIN capability.)

--nohostroute

Do not configure a host route pointing towards the PPTP server. (cf. ROUTING below)

--loglevel <level>

Sets the debugging level (0=low, 1=default, 2=high)

--test-type <n>

Enable packet reordering tests that damage the integrity of the packet stream to the server. Use this only when testing servers. Zero is the default, and means that packets are sent in the correct order. A value of one (1) causes a single swap between two packets, such that the sequence numbers might be 1 2 3 4 6 5 7 8 9. A value of two (2) causes ten packets to be buffered, then sent out of order but ascending, such that the sequence numbers might be 1 2 3 4 16 6 7 8 9 10 11 12 13 14 15 17 18 19 20. A value of three (3) causes ten packets to be buffered, then sent in the reverse order, like this; 1 2 3 4 16 15 14 13 12 11 10 9 8 7 6 5 17 18 19 20.

--test-rate <n>

Sets the number of packets to pass before causing a reordering test. Default is 100. Has no effect if test-type is zero. The result of test types 2 and 3 are undefined if this value is less than ten.

## ROUTING
When PPTP is used in conjunction with a default route on top of the tunnel (or just any route encompassing the PPTP server), the mechanics of routing would cause the PPTP packets themselves to be routed over the tunnel. This would result in an encapsulation loop, destroying connectivity.

pptp by default works around this by looking up the route towards the PPTP server at startup and configures a host route with that data. This essentially "freezes" routing for PPTP packets at the startup configuration. This behaviour can be disabled with --nohostroute if undesired (like when using --rtmark to implement policy routing).

NB: the route added by pptp is currently not deleted at exit!

## QUIRKS
BEZEQ_ISRAEL

modifies packets to interoperate with Orckit ADSL modems on the BEZEQ network in Israel.

## EXAMPLES
Connection to a Microsoft Windows VPN Server

pppd noauth nobsdcomp nodeflate require-mppe-128 name domain\\\\username remotename PPTP pty "pptp 10.0.0.5 --nolaunchpppd"

Note that the chap-secrets file used by pppd must include an entry for domain\\username

## STATISTICS
The pptp process collects statistics when sending and receiving GRE packets. They are intended to be useful for debugging poor PPTP performance and for general monitoring of link quality. The statistics are cumulative since the pptp process was started.

The statistics can be viewed by sending a SIGUSR1 signal to the "GRE-to-PPP Gateway" process, which will cause it to dump them to the system logs (at the LOG_NOTICE level). A better way to present the statistics to applications is being sought (e.g. SNMP?).

The following statistics are collected at the time of writing (April 2003):

rx accepted

the number of GRE packets successfully passed to PPP

rx lost

the number of packets never received, and presumed lost in the network

rx under win

the number of packets which were duplicates or had old sequence numbers (this might be caused by a packet-reordering network if your reordering timeout is set too low)

rx over win

the number of packets which were too far ahead in the sequence to be reordered (might be caused by loss of more than 300 packets in a row)

rx buffered

the number of packets which were slightly ahead of sequence, and were either buffered for reordering, or if buffering is disabled, accepted immediately (resulting in the intermediate packets being discarded).

rx OS errors

the number of times where the operating system reported an error when we tried to read a packet

rx truncated

the number of times we received a packet which was shorter than the length implied by the GRE header

rx invalid

the number of times we received a packet which had invalid or unsupported flags set in the header, wrong version, or wrong protocol.

rx acks

the number of pure acknowledgements received (without data). Too many of these will waste bandwidth, and might be solved by tuning the remote host.

tx sent

the number of GRE packets sent with data

tx failed

the number of packets we tried to send, but the OS reported an error

tx short

the number of times the OS would not let us write a complete packet

tx acks

the number of times we sent a pure ack, without data

tx oversize

the number of times we couldn't send a packet because it was over PACKET_MAX bytes long

round trip

the estimated round-trip time in milliseconds

## SEE ALSO
pppd(8)

Documentation in /usr/share/doc/pptp

## AUTHOR
This manual page was written by James Cameron <james.cameron@hp.com> from text contributed by Thomas Quinot <thomas@debian.org>, for the Debian GNU/Linux system. The description of the available statistics was written by Chris Wilson <chris@netservers.co.uk>. Updates for the Debian distribution by Ola Lundqvist <opal@debian.org>.

branch: sisyphus


pptpsetup

title: pptpsetup(8)

summary: Point\-to\-Point Tunneling Protocol setup

text:
# pptpsetup(8)

## NAME
pptpsetup - Point-to-Point Tunneling Protocol setup

## SYNOPSIS

```
    pptpsetup --create <TUNNEL> --server <SERVER> [--domain <DOMAIN>]
              --username <USERNAME> [--password <PASSWORD>]
              [--encrypt] [--start]
    pptpsetup --delete <TUNNEL>
```

## DESCRIPTION
PPTP Client is a Linux, FreeBSD, NetBSD and OpenBSD client for the proprietary Microsoft Point-to-Point Tunneling Protocol, PPTP.

This script configures PPTP Client on Linux.

## OPTIONS
--create TUNNEL

create a tunnel named TUNNEL

--delete TUNNEL

delete the file /etc/ppp/peers/TUNNEL and any lines from /etc/ppp/chap-secrets that contains "TUNNEL" as a single word

--server SERVER

the IP address or host name of the server

--domain DOMAIN

the authentication domain name (optional)

--username USERNAME

the username you are to use

--password PASSWORD

the password you are to use. If you don't specify a password, pptpsetup will ask for one.

--encrypt

whether encryption is required

--start

whether the connection should be started after configuration.

## AUTHOR
Nelson Ferraz <nferraz at gmail.com>, based on James Cameron's PPTP Client Debian HOWTO.

## SEE ALSO
PPTP Client Debian HOWTO

http://pptpclient.sourceforge.net/howto-debian.phtml

PPTP Client Diagnosis HOWTO

http://pptpclient.sourceforge.net/howto-diagnosis.phtml

## COPYRIGHT
pptpsetup - Point-to-Point Tunneling Protocol setup

Copyright (C) 2006 Nelson Ferraz

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA


bcrelay

package: pptpd

title: bcrelay(8)

summary: a broadcast relay daemon

text:
# bcrelay(8)

## NAME
bcrelay - a broadcast relay daemon

## SYNOPSIS
bcrelay [OPTION]...

## DESCRIPTION
bcrelay simply plays as a broadcast repeater. When bcrelay receives packets from the incoming interface, it will then relay them to the outgoing interface.

## OPTIONS
-d,--daemon

Run bcrelay as a daemon.

-p,--pidfile pid-file

specifies an alternate location to store the process ID file (default /var/run/bcrelay.pid).

-h,--help

Show help message.

-i,--incoming interface-in

Defines from which interface broadcasts will be read.

-s,--outgoing interface-out

Defines to which interface broadcasts will be relayed.

-n,--nolog

Disable any logging and tracing to /var/log/messages except fatal error messages.

-s,--ipsec argument

Defines an ipsec tunnel to be relayed to. Since ipsec tunnels terminate on the same interface, we need to define the broadcast address of the other end-point of the tunnel. This is done as ipsec0:x.x.x.255.

-v,--version

Show the version of bcrelay.

Log messages and debugging information go to syslog as daemon.

Interfaces can be specified as regexpressions, ie. ppp[0-9]+.

## AUTHORS
Original bcrelay program was written by Luc Richards <TheyCallMeLuc@yahoo.com.au>.

Bcrelay was modified for poptop by Richard de Vroede <r.devroede@linvision.com> and rewritten by Norbert van Bolhuis <norbert@vanbolhuis.demon.nl> for version (v1.0+) of bcrelay.

This manual page was written by Nguyen Vinh for Debian GNU/Linux System (but may be used for others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License Version 2, and any later versions published by Free Software Foundation. There is no WARRANTY, to the extent permitted by the law.

## SEE ALSO
For more detailed information about bcrelay, please read README.


pptpctrl

title: pptpctrl(8)

text:
# pptpctrl(8)

## NAME
pptpctrl - PPTP control connection manager

## SYNOPSIS
pptpctrl pptp-debug-flag no-ipparam-flag ppp-options-value ppp-speed-value ppp-local-ip-value ppp-remote-ip-value [ pptp-call-id ] [ ppp-binary ] [ pptp-logwtmp ]

## DESCRIPTION
pptpctrl is usually run by pptpd(8), but can also be run from inetd(8) if some of the features of pptpd(8), such as IP pool management, and inbuilt TCP wrappers, are not required.

## OPTIONS
pptpctrl options are unconventional, as they are designed for use by pptpd(8) rather than users. The option order is critical. Flag options consist of a 0 or 1, and must be present. Value options consist of a 0, or a 1 followed by the value. Either the 0 or both the 1 and the value must be present. The remaining options are optional, but must be present in the defined order. The options are as follows:

pptp-debug-flag

if set (1), enables debug messages to syslog from pptpctrl. This has no effect on the setting of the PPP debug option.

no-ipparam-flag

if set, pptpctrl will not pass the client's IP address to pppd(8) using the ipparam option. See the noipparam option in pptpd.conf(5).

ppp-options-value

file to use for PPP options. See the file option in pppd(8).

ppp-speed-value

value for the speed option given to pppd(8). Note that on Linux, this parameter is ineffective.

ppp-local-ip-value

if set, specifies the IP address that pppd(8) is to use for the network interface on the server. If not set, pppd(8) will determine it based on options; usually it will be the ethernet address of the server.

ppp-remote-ip-value

if set, specifies the IP address that pppd(8) is to use for the network interface on the client. If not set, pppd(8) will determine it based on options; usually it will be the ethernet address of the client, or an address given in chap-secrets. Must be set if ppp-local-ip-value is set.

pptp-call-id

if present, specifies the call identification for the PPTP session. If omitted, the call identification is zero. Normally the ID is allocated by pptpd(8) and passed to pptpctrl.

ppp-binary

if present, path to the PPP binary to use. If omitted, the default value is used.

pptp-logwtmp

if present, specifies whether wtmp(5) should be updated as users connect and disconnect.

## FILES
none.

## AUTHORS
Poptop is written by Matthew Ramsay <matthewr@moreton.com.au>, David Luyer <luyer@ucs.uwa.edu.au>, Kevin Thayer <tmk@netmagic.net>, Peter Galbavy <Peter.Galbavy@knowledge.com> and others. Development has been moved to SourceForge and worked on by Richard de Vroede <r.devroede@linvision.com> since June 26, 2002.

## COPYRIGHT
Copyright © 1999 Matthew Ramsay and others.

Poptop is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

Poptop is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Poptop; see the file COPYING. If not, write to the Free Software Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

## AVAILABILITY
The most recent version of Poptop is available for download from SourceForge at http://sourceforge.net/projects/poptop.

## SEE ALSO
inetd(8), inetd.conf(5), pppd(8), pptpd(8), pptpd.conf(5), tcpd(8).


pptpd

title: pptpd(8)

text:
# pptpd(8)

## NAME
pptpd - PPTP VPN daemon

## SYNOPSIS
pptpd [ options ]

## DESCRIPTION
pptpd is the Poptop PPTP daemon, which manages tunnelled PPP connections encapsulated in GRE using the PPTP VPN protocol. It may contain features like IP address management and TCP wrappers if compiled in.

## OPTIONS
Here we document the command line options. See pptpd.conf(5) for configuration directives, IP address allocation, routing, and firewall rules.

-b|--bcrelay internal-interface

specifies that broadcasts received on the server's internal network interface should be relayed to the clients.

-c|--conf conf-file

specifies the configuration file for pptpd (default /etc/pptpd.conf)

-d|--debug

turns on debugging mode, causing more debugging messages to be sent to syslog.

-e|--ppp pppd-program

use pppd-program in place of the default pppd(8).

-f|--fg

run in the foreground instead of detaching from terminal

-h|--help

display program usage.

-i|--noipparam

do not send the client's IP address to ip-up scripts (required if you are using the pppd(8) ipparam option for some other purpose).

-l|--listen x.x.x.x

specifies the local interface IP address to listen on.

-o|--option ppp-conf-file

specifies that pptpd should specify an alternate configuration file for the ppp daemon (the default is normally /etc/ppp/options but may vary depending on your ppp daemon).

-p|--pidfile pid-file

specifies an alternate location to store the process ID file (default /run/pptpd.pid).

-s|--speed baud

specifies that the speed baud should be passed to the ppp daemon as the tty speed to use (in some cases this is ignored by the ppp daemon).

-t|--stimeout seconds

specifies the number of seconds to wait for the first packet before dropping the connection. This is a denial of service protection feature.

-w|--logwtmp

update wtmp(5) as users connect and disconnect. See wtmp(1).

-C|--connections n

limits the number of client connections that may be accepted. Corresponds to the connections option in pptpd.conf. If pptpd is allocating IP addresses (e.g. --delegate is not used) then the number of connections is also limited by the remoteip option in pptpd.conf.

-D|--delegate

delegates the allocation of client IP addresses to pppd(8). Without this option, which is the default, pptpd manages the list of IP addresses for clients and passes the next free address to pppd. With this option, pptpd does not pass an address, and so pppd may use radius or chap-secrets to allocate an address.

-V|--vrf vrf-name

specifies the VRF to be used for listening in.

-v|--version

displays the current version of the pptp daemon.

## FILES
/etc/pptpd.conf

/run/pptpd.pid

## DEBUGGING
To turn on debugging, add 'debug' to /etc/pptpd.conf and your PPP options file, and restart pptpd.

Typically the PPP options file is options.pptpd in /etc/ppp, though on some distributions it may be pptpd-options. Use your package manager to find it, e.g. 'rpm -ql pptpd | grep options' or 'dpkg --listfiles pptpd | grep options'.

You may need to configure syslogd to catch debug messages. e.g. edit /etc/syslog.conf and add something similar to the example below, then restart syslogd.

\# debug logging

*.debug;mail.none /var/log/debug

This will log all debug information, except mail, to the file /var/log/debug. Note that this is a lot of information and might flood your disks. If performance is an issue, you can try turning off sync during your debugging, by prefixing the destination with '-'.

\# debug logging

*.debug;mail.none -/var/log/debug

Disable this line and restart syslog after you are done debugging. See the syslog man pages for more details.

## AUTHORS
Poptop is written by Matthew Ramsay <matthewr@moreton.com.au>, David Luyer <luyer@ucs.uwa.edu.au>, Kevin Thayer <tmk@netmagic.net>, Peter Galbavy <Peter.Galbavy@knowledge.com> and others. Development has been moved to SourceForge and worked on by Richard de Vroede <r.devroede@linvision.com> since June 26, 2002.

## COPYRIGHT
Copyright © 1999 Matthew Ramsay and others.

Poptop is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

Poptop is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with Poptop; see the file COPYING. If not, write to the Free Software Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

## AVAILABILITY
The most recent version of Poptop is available for download from SourceForge at http://sourceforge.net/projects/poptop.

## SEE ALSO
pppd(8), pptpd(8), pptpd.conf(5).


execstack

package: prelink-tools

title: execstack(8)

text:
# execstack(8)

## NAME
execstack - tool to set, clear, or query executable stack flag of ELF binaries and shared libraries

## SYNOPSIS
execstack [OPTION...] [FILES]

## DESCRIPTION
execstack is a program which sets, clears, or queries executable stack flag of ELF binaries and shared libraries. Linux has in the past allowed execution of instructions on the stack and there are lots of binaries and shared libraries assuming this behaviour. Furthermore, GCC trampoline code for e.g. nested functions requires executable stack on many architectures. To avoid breaking binaries and shared libraries which need executable stack, ELF binaries and shared libraries now can be marked as requiring executable stack or not requiring it. This marking is done through the p_flags field in the PT_GNU_STACK program header entry. If the marking is missing, kernel or dynamic linker need to assume it might need executable stack. The marking is done automatically by recent GCC versions (objects using trampolines on the stack are marked as requiring executable stack, all other newly built objects are marked as not requiring it) and linker collects these markings into marking of the whole binary or shared library. The user can override this at assembly time (through --execstack or --noexecstack assembler options), at link time (through -z execstack or -z noexecstack linker options) and using the execstack tool also on an already linker binary or shared library. This tool is especially useful for third party shared libraries where it is known that they don't need executable stack or testing proves it.

## OPTIONS
-s --set-execstack

Mark binary or shared library as requiring executable stack.

-c --clear-execstack

Mark binary or shared library as not requiring executable stack.

-q --query

Query executable stack marking of binaries and shared libraries. For each file it prints either - when executable stack is not required, X when executable stack is required or ? when it is unknown whether the object requires or doesn't require executable stack (the marking is missing).

-V

Print execstack version and exit.

-? --help

Print help message.

--usage

Print a short usage message.

## ARGUMENTS
Command line arguments should be names of ELF binaries and shared libraries which should be modified or queried.

## EXAMPLES
\# execstack -s ~/lib/libfoo.so.1

will mark ~/lib/libfoo.so.1 as requiring executable stack.

\# execstack -c ~/bin/bar

will mark ~/bin/bar as not requiring executable stack. # execstack -q ~/lib/libfoo.so.1 ~/bin/bar

will query executable stack marking of the given files.

## SEE ALSO
ld.so(8).

## BUGS
execstack doesn't support yet marking of executables if they do not have PT_GNU_STACK program header entry nor they have room for program segment header table growth.

## AUTHORS
Jakub Jelinek <jakub@redhat.com>.


prelink

title: prelink(8)

text:
# prelink(8)

## NAME
prelink - prelink ELF shared libraries and binaries to speed up startup time

## SYNOPSIS
prelink [OPTION...] [FILES]

## DESCRIPTION
prelink is a program that modifies ELF shared libraries and ELF dynamically linked binaries in such a way that the time needed for the dynamic linker to perform relocations at startup significantly decreases. Due to fewer relocations, the run-time memory consumption decreases as well (especially the number of unshareable pages). The prelinking information is only used at startup time if none of the dependent libraries have changed since prelinking; otherwise programs are relocated normally.

prelink first collects ELF binaries to be prelinked and all the ELF shared libraries they depend on. Then it assigns a unique virtual address space slot to each library and relinks the shared library to that base address. When the dynamic linker attempts to load such a library, unless that virtual address space slot is already occupied, it maps the library into the given slot. After this is done, prelink, with the help of dynamic linker, resolves all relocations in the binary or library against its dependent libraries and stores the relocations into the ELF object. It also stores a list of all dependent libraries together with their checksums into the binary or library. For binaries, it also computes a list of conflicts (relocations that resolve differently in the binary's symbol search scope than in the smaller search scope in which the dependent library was resolved) and stores it into a special ELF section.

At runtime, the dynamic linker first checks whether all dependent libraries were successfully mapped into their designated address space slots, and whether they have not changed since the prelinking was done. If all checks are successful, the dynamic linker just replays the list of conflicts (which is usually significantly shorter than total number of relocations) instead of relocating each library.

## OPTIONS
-v --verbose

Verbose mode. Print the virtual address slots assigned to libraries and what binary or library is currently being prelinked.

-n --dry-run

Don't actually prelink anything; just collect the binaries/libraries, assign them addresses, and with -v print what would be prelinked.

-a --all

Prelink all binaries and dependent libraries found in directory hierarchies specified in /etc/prelink.conf. Normally, only binaries specified on the command line and their dependent libraries are prelinked.

-m --conserve-memory

When assigning addresses to libraries, allow overlap of address space slots provided that the two libraries are not present together in any of the binaries or libraries. This results in a smaller virtual address space range used for libraries. On the other hand, if prelink sees a binary during incremental prelinking which puts together two libraries which were not present together in any other binary and were given the same virtual address space slots, then the binary cannot be prelinked. Without this option, each library is assigned a unique virtual address space slot.

-R --random

When assigning addresses to libraries, start with a random address within the architecture-dependent virtual address space range. This can make some buffer overflow attacks slightly harder to exploit, because libraries are not present on the same addresses across different machines. Normally, assigning virtual addresses starts at the bottom of the architecture-dependent range.

-r --reloc-only=ADDRESS

Instead of prelinking, just relink given shared libraries to the specified base address.

-N --no-update-cache

Don't save the cache file after prelinking. Normally, the list of libraries (and with -m binaries also) is stored into the /etc/prelink.cache file together with their given address space slots and dependencies, so the cache can be used during incremental prelinking (prelinking without -a option).

-c --config-file=CONFIG

Specify an alternate config file instead of default /etc/prelink.conf.

-C --cache-file=CACHE

Specify an alternate cache file instead of default /etc/prelink.cache.

-f --force

Force re-prelinking even for already prelinked objects whose dependencies are unchanged. This option causes new virtual address space slots to be assigned to all libraries. Normally, only binaries or libraries which are either not prelinked yet, or whose dependencies have changed, are prelinked.

-q --quick

Run prelink in quick mode. This mode checks just mtime and ctime timestamps of libraries and binaries stored in the cache file. If they are unchanged from the last prelink run, it is assumed that the library in question did not change, without parsing or verifying its ELF headers.

-p --print-cache

Print the contents of the cache file (normally /etc/prelink.cache) and exit.

--dynamic-linker=LDSO

Specify an alternate dynamic linker instead of the default.

--ld-library-path=PATH

Specify a special LD_LIBRARY_PATH to be used when prelink queries the dynamic linker about symbol resolution details.

--libs-only

Only prelink ELF shared libraries, don't prelink any binaries.

-h --dereference

When processing command line directory arguments, follow symbolic links when walking directory hierarchies.

-l --one-file-system

When processing command line directory arguments, limit directory tree walk to a single file system.

-u --undo

Revert binaries and libraries to their original content before they were prelinked. Without the -a option, this causes only the binaries and libraries specified on the command line to be reverted to their original state (and e.g. not their dependencies). If used together with the -a option, all binaries and libraries from command line, all their dependencies, all binaries found in directories specified on command line and in the config file, and all their dependencies are undone.

-y --verify

Verifies a prelinked binary or library. This option can be used only on a single binary or library. It first applies an --undo operation on the file, then prelinks just that file again and compares this with the original file. If both are identical, it prints the file after --undo operation on standard output and exits with zero status. Otherwise it exits with error status. Thus if --verify operation returns zero exit status and its standard output is equal to the content of the binary or library before prelinking, you can be sure that nobody modified the binaries or libraries after prelinking. Similarly with message digests and checksums (unless you trigger the improbable case of modified file and original file having the same digest or checksum).

--md5

This is similar to --verify option, except instead of outputting the content of the binary or library before prelinking to standard output, MD5 digest is printed. See md5sum(1).

--sha

This is similar to --verify option, except instead of outputting the content of the binary or library before prelinking to standard output, SHA1 digest is printed. See sha1sum(1).

--exec-shield --no-exec-shield

On IA-32, if the kernel supports Exec-Shield, prelink attempts to lay libraries out similarly to how the kernel places them (i.e. if possible below the binary, most widely used into the ASCII armor zone). These switches allow overriding prelink detection of whether Exec-Shield is supported or not.

-b --black-list=PATH

This option allows blacklisting certain paths, libraries or binaries. Prelink will not touch them during prelinking.

-o --undo-output=FILE

When performing an --undo operation, don't overwrite the prelinked binary or library with its original content (before it was prelinked), but save that into the specified file.

-V --version

Print version and exit.

-? --help

Print short help and exit.

## ARGUMENTS
Command-line arguments should be either directory hierarchies (in which case -l and -h options apply), or particular ELF binaries or shared libraries. Specifying a shared library explicitly on the command line causes it to be prelinked even if no binary is linked against it. Otherwise, binaries are collected together and only the libraries they depend on are prelinked with them.

## EXAMPLES
\# /usr/sbin/prelink -avmR

prelinks all binaries found in directories specified in /etc/prelink.conf and all their dependent libraries, assigning libraries unique virtual address space slots only if they ever appear together, and starts assigning libraries at a random address.

\# /usr/sbin/prelink -vm ~/bin/progx

prelinks ~/bin/progx program and all its dependent libraries (unless they were prelinked already e.g. during prelink -a invocation). # /usr/sbin/prelink -au

reverts all binaries and libraries to their original content. # /usr/sbin/prelink -y /bin/prelinked_prog > /tmp/original_prog; echo $? verifies whether /bin/prelinked_prog is unchanged.

## FILES
/etc/prelink.cache

Binary file containing a list of prelinked libraries and/or binaries together with their assigned virtual address space slots and dependencies. You can run /usr/sbin/prelink -p to see what is stored in there.

/etc/prelink.conf

Configuration file containing a list of directory hierarchies that contain ELF shared libraries or binaries which should be prelinked. This configuration file is used in -a mode to find binaries which should be prelinked and also, no matter whether -a is given or not, to limit which dependent shared libraries should be prelinked. If prelink finds a dependent library of some binary or other library which is not present in any of the directories specified either in /etc/prelink.conf or on the command line, then it cannot be prelinked. Each line of the config file should be either a comment starting with #, or a directory name, or a blacklist specification. Directory names can be prefixed by the -l switch, meaning the tree walk of the given directory is only limited to one file system; or the -h switch, meaning the tree walk of the given directory follows symbolic links. A blacklist specification should be prefixed by -b and optionally also -l or -h if needed. A blacklist entry can be either an absolute directory name (in that case all files in that directory hierarchy are ignored by the prelinker); an absolute filename (then that particular library or binary is skipped); or a glob pattern without a / character in it (then all files matching that glob in any directory are ignored).

## SEE ALSO
ldd(1), ld.so(8).

## BUGS
prelink Some architectures, including IA-64 and HPPA, are not yet supported.

## AUTHORS
Jakub Jelinek <jakub@redhat.com>.


privoxy

package: privoxy

title: privoxy(8)

summary: Privacy Enhancing Proxy

text:
# privoxy(8)

## NAME
privoxy - Privacy Enhancing Proxy

## SYNOPSIS
privoxy [--chroot ] [--config-test ] [--help ] [--no-daemon ] [--pidfile pidfile ] [--pre-chroot-nslookup hostname ] [--user user[.group] ] [--version ] [configfile ]

## OPTIONS
Privoxy may be invoked with the following command line options:

--chroot

Before changing to the user ID given in the --user option, chroot to that user's home directory, i.e. make the kernel pretend to the Privoxy process that the directory tree starts there. If set up carefully, this can limit the impact of possible vulnerabilities in Privoxy to the files contained in that hierarchy.

--config-test

Exit after loading the configuration files before binding to the listen address. The exit code signals whether or not the configuration files have been successfully loaded. If the exit code is 1, at least one of the configuration files is invalid, if it is 0, all the configuration files have been successfully loaded (but may still contain errors that can currently only be detected at run time).

This option doesn't affect the log setting, combination with "--no-daemon" is recommended if a configured log file shouldn't be used.

--help

Print brief usage info and exit.

--no-daemon

Don't become a daemon, i.e. don't fork and become process group leader, don't detach from controlling tty, and do all logging there.

--pidfile pidfile

On startup, write the process ID to pidfile. Delete the pidfile on exit. Failure to create or delete the pidfile is non-fatal. If no --pidfile option is given, no PID file will be used.

--pre-chroot-nslookup hostname

Initialize the resolver library using hostname before chroot'ing. On some systems this reduces the number of files that must be copied into the chroot tree.

--user user[.group]

After (optionally) writing the PID file, assume the user ID of user and the GID of group, or, if the optional group was not given, the default group of user. Exit if the privileges are not sufficient to do so.

--version

Print version info and exit.

If the configfile is not specified on the command line, Privoxy will look for a file named config in the current directory. If no configfile is found, Privoxy will fail to start.

## DESCRIPTION
Privoxy is a non-caching web proxy with advanced filtering capabilities for enhancing privacy, modifying web page data and HTTP headers, controlling access, and removing ads and other obnoxious Internet junk. Privoxy has a flexible configuration and can be customized to suit individual needs and tastes. It has application for both stand-alone systems and multi-user networks.

Privoxy is Free Software and licensed under the GNU GPLv2 or later.

Privoxy is an associated project of Software in the Public Interest (SPI).

Helping hands and donations are welcome:

•

https://www.privoxy.org/participate

•

https://www.privoxy.org/donate

## INSTALLATION AND USAGE
Browsers can either be individually configured to use Privoxy as a HTTP proxy (recommended), or Privoxy can be combined with a packet filter to build an intercepting proxy (see config). The default setting is for localhost, on port 8118 (configurable in the main config file). To set the HTTP proxy in Firefox, go through: Tools; Options; General; Connection Settings; Manual Proxy Configuration.

For Internet Explorer, go through: Tools; Internet Properties; Connections; LAN Settings.

The Secure (SSL) Proxy should also be set to the same values, otherwise https: URLs will not be proxied. Note: Privoxy can only proxy HTTP and HTTPS traffic. Do not try it with FTP or other protocols. HTTPS presents some limitations, and not all features will work with HTTPS connections.

For other browsers, check the documentation.

## CONFIGURATION
Privoxy can be configured with the various configuration files. The default configuration files are: config, default.filter, default.action and default.action. user.action should be used for locally defined exceptions to the default rules in match-all.action and default.action, and user.filter for locally defined filters. These are well commented. On Unix and Unix-like systems, these are located in /etc/privoxy/ by default.

Privoxy uses the concept of actions in order to manipulate the data stream between the browser and remote sites. There are various actions available with specific functions for such things as blocking web sites, managing cookies, etc. These actions can be invoked individually or combined, and used against individual URLs, or groups of URLs that can be defined using wildcards and regular expressions. The result is that the user has greatly enhanced control and freedom.

The actions list (ad blocks, etc) can also be configured with your web browser at http://config.privoxy.org/ (assuming the configuration allows it). Privoxy's configuration parameters can also be viewed at the same page. In addition, Privoxy can be toggled on/off. This is an internal page, and does not require Internet access.

See the User Manual for a detailed explanation of installation, general usage, all configuration options, new features and notes on upgrading.

## FILES

```
 /usr/sbin/privoxy

 /etc/privoxy/config

 /etc/privoxy/match-all.action

 /etc/privoxy/default.action

 /etc/privoxy/user.action

 /etc/privoxy/default.filter

 /etc/privoxy/user.filter

 /etc/privoxy/trust

 /etc/privoxy/templates/*

 /var/log/privoxy/logfile
```

Various other files should be included, but may vary depending on platform and build configuration. Additional documentation should be included in the local documentation directory.

## SIGNALS
Privoxy terminates on the SIGINT and SIGTERM signals. Log rotation scripts may cause a re-opening of the logfile by sending a SIGHUP to Privoxy. Note that unlike other daemons, Privoxy does not need to be made aware of config file changes by SIGHUP -- it will detect them automatically. Signals other than the ones listed above aren't explicitly handled and result in the default action defined by the operating system.

## NOTES
Please see the User Manual on how to contact the developers, for feature requests, reporting problems, and other questions.

## SEE ALSO
Other references and sites of interest to Privoxy users:

https://www.privoxy.org/, the Privoxy Home page.

https://www.privoxy.org/faq/, the Privoxy FAQ.

https://www.privoxy.org/developer-manual/, the Privoxy developer manual.

https://sourceforge.net/projects/ijbswa/, the Project Page for Privoxy on SourceForge.

http://config.privoxy.org/, the web-based user interface. Privoxy must be running for this to work. Shortcut: http://p.p/

https://sourceforge.net/p/ijbswa/actionsfile-feedback/, to submit ``misses'' and other configuration related suggestions to the developers.

## DEVELOPMENT TEAM

```
 Fabian Keil, lead developer

 David Schmidt

 Lee Rian

 Roland Rosenfeld

 Ian Silvester
```

## COPYRIGHT AND LICENSE

### COPYRIGHT
Copyright (C) 2001-2026 by Privoxy Developers <privoxy-devel@lists.privoxy.org>

Some source code is based on code Copyright (C) 1997 by Anonymous Coders and Junkbusters, Inc.

### LICENSE
Privoxy is free software; you can redistribute and/or modify its source code under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the license, or (at your option) any later version.

The same is true for Privoxy binaries unless they are linked with a mbed TLS or OpenSSL version that is licensed under the Apache 2.0 license or against a wolfSSL version that is licensed under the GPL 3 in which case you can redistribute and/or modify the Privoxy binaries under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the license, or (at your option) any later version.

Privoxy is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the license for details.


procinfo-ng

package: procinfo-ng

title: procinfo-ng(8)

text:
# procinfo-ng(8)

## NAME
procinfo-ng - display system statistics gathered from /proc

## SYNOPSIS
procinfo-ng [ -dDSbrhv ] [ -nN ]

## DESCRIPTION
procinfo-ng gathers some system data from the /proc directory and prints it nicely formatted on the standard output device.

The meanings of the fields are as follows:

Memory:

See the man page for free(1)

Bootup:

The time the system was booted.

Load average:

The average number of jobs running, followed by the number of runnable processes and the total number of processes, followed by the PID of the last process run. The pid of the last running process will probably always be procinfo's PID.

user:

The amount of time spent running jobs in user space.

nice:

The amount of time spent running niced jobs in user space.

system:

The amount of time spent running in kernel space. Note: the time spent servicing interrupts is not counted by the kernel (and nothing that procinfo-ng can do about it).

idle:

The amount of time spent doing nothing.

uptime:

The time that the system has been up. The above four should more or less add up to this one.

page in:

The number of disk blocks paged into core from disk. 1 block is equal to 1 kiB.

page out:

The number of disk blocks paged out of core to disk. This includes regular disk-writes.

swap in:

The number of memory pages paged in from swap.

swap out:

The number of memory pages paged out to swap.

context:

The number of context switches, either since bootup or per interval.

Disk stats(hda, hdb, sda, sdb):

The number of reads and writes made to disks, whether CD-ROM, hard-drive, or USB. Shows all disks if they either are an hdX or sdX, or if they have a non-zero read/write count.

Interrupts:

Number of interrupts serviced since boot, or per interval, listed per IRQ.

## OPTIONS

-nN

Pause N second between updates. It may contain a decimal point. The default is 5 seconds. When run by root with a pause of 0 seconds, the program will run at the highest possible priority level.

-d

For memory, CPU times, paging, swapping, disk, context and interrupt stats, display values per second rather than totals.

-D

Same as -d, except that memory stats are displayed as totals.

-S

When running with -d or -D, always show values per second, even when running with -n N with N greater than one second.

-b

Display numbers of bytes rather than number of I/O requests.

-r

This option adds an extra line to the memory info showing 'real' free memory, just as free(1) does. The numbers produced assume that Buffers and Cache are disposable.

-H

Displays memory stats in 'Human' (base 1024) numbers (KiB, MiB, GiB), instead of implied KBytes.

-h

Print a brief help message.

-v

Print version info.

## INTERACTIVE COMMANDS
When running procinfo-ng fullscreen, you can change its behaviour by pressing d, D, S, r and b, which toggle the flags that correspond to their same-named commandline-options. In addition you can press q which quits the program.

## FILES
/proc

The proc file system.

## BUGS
All of these statistics are taken verbatim from the kernel, without any scaling. Any case where the kernel specifies that a particular field means something different from how it is documented in this man-page, the kernel always wins.

Some features of the original procinfo were elided, as they were considered non-useful, especially as many of them don't change anymore, and have better utilities for listing/displaying them.

## SEE ALSO
free(1), uptime(1), w(1), init(8), proc(5).

## AUTHOR
Adam Schrotenboer <adam@tabris.net>


slabtop

package: procps

title: slabtop(8)

text:
# slabtop(8)

## NAME
slabtop - display kernel slab cache information in real time

## SYNOPSIS
slabtop [option ...]

## DESCRIPTION
slabtop displays detailed kernel slab cache information in real time. It displays a listing of the top caches sorted by one of the listed sort criteria. It also displays a statistics header filled with slab layer information.

## OPTIONS
Normal invocation of slabtop does not require any options. The behavior, however, can be fine-tuned by specifying one or more of the following flags:

-d, --delay=N

Refresh the display every n in seconds. By default, slabtop refreshes the display every three seconds. To exit the program, hit q. This cannot be combined with the -o option.

-s, --sort=S

Sort by S, where S is one of the sort criteria.

-o, --once

Display the output once and then exit.

--human

Show slab sizes automatically scaled to shortest three digit unit and display the units of print out. Following units are used.

```
  B = bytes

  Ki = kibibyte

  Mi = mebibyte

  Gi = gibibyte

  Ti = tebibyte

  Pi = pebibyte
```

If this flag is not used, the slab sizes will be shown in KiB.

-V, --version

Display version information and exit.

-h, --help

Display usage information and exit.

## SORT CRITERIA
The following are valid sort criteria used to sort the individual slab caches and thereby determine what are the "top" slab caches to display. The default sort criteria is to sort by the number of objects ("o").

The sort criteria can also be changed while slabtop is running by pressing the associated character.

character

description

header

a

number of active objects

ACTIVE

b

objects per slab

OBJ/SLAB

c

cache size

CACHE SIZE

l

number of slabs

SLABS

v

number of active slabs

N/A

n

name

NAME

o

number of objects

OBJS

p

pages per slab

N/A

s

object size

OBJ SIZE

u

cache utilization

USE

## COMMANDS
slabtop accepts keyboard commands from the user during use. The following are supported. In the case of letters, both cases are accepted.

Each of the valid sort characters are also accepted, to change the sort routine. See the section SORT CRITERIA.

<SPACEBAR>

Refresh the screen.

Q

Quit the program.

## FILES
/proc/slabinfo

slab information

## SEE ALSO
free(1), ps(1), top(1), vmstat(8)

## NOTES
Currently, slabtop requires a 2.4 or later kernel (specifically, a version 1.1 or later /proc/slabinfo). Kernel 2.2 should be supported in the future.

The slabtop statistic header is tracking how many bytes of slabs are being used and is not a measure of physical memory. The 'Slab' field in the /proc/meminfo file is tracking information about used slab physical memory.

The CACHE SIZE column is not accurate, it's the upper limit of memory used by specific slab. When system using slub (most common case) is under high memory pressure, there are slab order fallbacks, which means "pages per slab" is not constant and may decrease.

## AUTHORS
Written by Chris Rivera and Robert Love.

slabtop was inspired by Martin Bligh's perl script, vmtop.

## REPORTING BUGS
Please send bug reports to procps@freelists.org.


sysctl

title: sysctl(8)

summary: configure kernel parameters at runtime

text:
# sysctl(8)

## NAME
sysctl - configure kernel parameters at runtime

## SYNOPSIS
sysctl [option ...] variable[=value] ...

sysctl -p file-or-regexp ...

## DESCRIPTION
sysctl is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/. Procfs is required for sysctl support in Linux. You can use sysctl to both read and write sysctl data.

## PARAMETERS
variable

The name of a key to read from. An example is kernel.ostype. The '/' separator is also accepted in place of a '.'.

variable=value

To set a key, use the form variable=value where variable is the key and value is the value to set it to. If the value contains quotes or characters which are parsed by the shell, you may need to enclose the value in double quotes.

-n, --values

Use this option to disable printing of the key name when printing values.

-e, --ignore

Use this option to ignore errors about unknown keys.

-N, --names

Use this option to only print the names. It may be useful with shells that have programmable completion.

-q, --quiet

Use this option to not display the values set to stdout.

-v, --verbose

Use this option to display the values set to stdout.

-w, --write

Force all arguments to be write arguments and print an error if they cannot be parsed this way.

-p[FILE], --load[=FILE]

Load in sysctl settings from the file specified or /etc/sysctl.conf if none given. Specifying - as filename means reading data from standard input. Using this option will mean arguments to sysctl are files, which are read in the order they are specified. The file argument may be specified as regular expression.

-a, --all

Display all values currently available except deprecated and verboten parameters.

--deprecated

Include deprecated parameters to --all values listing.

-b, --binary

Print value without new line.

--system

Load settings from all system configuration files. See the SYSTEM FILE PRECEDENCE section below.

-r, --pattern pattern

Only apply settings that match pattern. The pattern uses extended regular expression syntax.

-A

Alias of -a

-d

Alias of -h

-f

Alias of -p

-X

Alias of -a

-o

Does nothing, exists for BSD compatibility.

-x

Does nothing, exists for BSD compatibility.

-h, --help

Display help text and exit.

-V, --version

Display version information and exit.

## FILES
/proc/sys

/etc/sysctl.d/*.conf

/run/sysctl.d/*.conf

/usr/local/lib/sysctl.d/*.conf

/usr/lib/sysctl.d/*.conf

/lib/sysctl.d/*.conf

/etc/sysctl.conf

## NOTES

### System file precedence
When using the --system option, sysctl will read files from directories in the following list in given order from top to bottom. Once a file of a given filename is loaded, any file of the same name in subsequent directories is ignored.

/etc/sysctl.d/*.conf

/run/sysctl.d/*.conf

/usr/local/lib/sysctl.d/*.conf

/usr/lib/sysctl.d/*.conf

/lib/sysctl.d/*.conf

All configuration files are sorted in lexicographic order, regardless of the directory they reside in. Configuration files can either be completely replaced (by having a new configuration file with the same name in a directory of higher priority) or partially replaced (by having a configuration file that is ordered later).

The file /etc/sysctl.conf is read last which means it can replace/override any parameters previously set in files in the listed directories.

### Deprecated parameters
The base_reachable_time and retrans_time are deprecated. The sysctl command does not allow changing values of these parameters. Users who insist to use deprecated kernel interfaces should push values to /proc file system by other means. For example:

echo 256 > /proc/sys/net/ipv6/neigh/eth0/base_reachable_time

### Verboten parameters
Certain kernel parameters should not be read due to side-effects and will be skipped by sysctl using the --all option.

stat_refresh

This parameter returns no value but flushes per-cpu vm statistics.

## EXAMPLES
/sbin/sysctl -a

/sbin/sysctl -n kernel.hostname

/sbin/sysctl -w kernel.domainname="example.com"

/sbin/sysctl -p/etc/sysctl.conf

/sbin/sysctl -a --pattern forward

/sbin/sysctl -a --pattern forward$

/sbin/sysctl -a --pattern 'net.ipv4.conf.(eth|wlan)0.arp'

/sbin/sysctl --pattern '^net.ipv6' --system

## SEE ALSO
proc(5), sysctl.conf(5), regex(7)

## REPORTING BUGS
Please send bug reports to procps@freelists.org.


vmstat

title: vmstat(8)

summary: Report virtual memory statistics

text:
# vmstat(8)

## NAME
vmstat - Report virtual memory statistics

## SYNOPSIS
vmstat [option ...] [delay [count]]

## DESCRIPTION
vmstat reports information about processes, memory, paging, block IO, traps, disks and cpu activity.

The first report produced gives averages since the last reboot. Additional reports give information on a sampling period of length delay. The process and memory reports are instantaneous in either case.

## OPTIONS
delay

The delay between updates in seconds. If no delay is specified, only one report is printed with the average values since boot.

count

Number of updates. In absence of count, when delay is defined, default is infinite.

-a, --active

Display active and inactive memory, given a 2.5.41 kernel or better.

-f, --forks

The -f switch displays the number of forks since boot. This includes the fork, vfork, and clone system calls, and is equivalent to the total number of tasks created. Each process is represented by one or more tasks, depending on thread usage. This display does not repeat.

-m, --slabs

Displays slabinfo.

-n, --one-header

Display the header only once rather than periodically.

-s, --stats

Displays a table of various event counters and memory statistics. This display does not repeat.

-d, --disk

Report disk statistics (2.5.70 or above required).

-D, --disk-sum

Report some summary statistics about disk activity.

-p, --partition device

Detailed statistics about partition (2.5.70 or above required).

-S, --unit character

Switches outputs between 1000 (k), 1024 (K), 1000000 (m), or 1048576 (M) bytes. Note this does not change the block (bi/bo) fields.

-t, --timestamp

Append timestamp to each line

-w, --wide

Wide output mode (useful for systems with higher amount of memory, where the default output mode suffers from unwanted column breakage). The output is wider than 80 characters per line.

-y, --no-first

Omits first report with statistics since system boot.

-V, --version

Display version information and exit.

-h, --help

Display help and exit.

## FIELD DESCRIPTION FOR VM MODE

### Procs

```
r: The number of runnable processes (running or waiting for run time).
b: The number of processes blocked waiting for I/O to complete.
```

### Memory
These are affected by the --unit option.

```
swpd: the amount of swap memory used.
free: the amount of idle memory.
buff: the amount of memory used as buffers.
cache: the amount of memory used as cache.
inact: the amount of inactive memory.  (-a option)
active: the amount of active memory.  (-a option)
```

### Swap
These are affected by the --unit option.

```
si: Amount of memory swapped in from disk (/s).
so: Amount of memory swapped to disk (/s).
```

### IO

```
bi: Kibibyte received from a block device (KiB/s).
bo: Kibibyte sent to a block device (KiB/s).
```

### System

```
in: The number of interrupts per second, including the clock.
cs: The number of context switches per second.
```

### CPU
These are percentages of total CPU time.

```
us: Time spent running non-kernel code.  (user time, including nice time)
sy: Time spent running kernel code.  (system time)
id: Time spent idle.  Prior to Linux 2.5.41, this includes IO-wait time.
wa: Time spent waiting for IO.  Prior to Linux 2.5.41, included in idle.
st: Time stolen from a virtual machine.  Prior to Linux 2.6.11, unknown.
gu: Time spent running KVM guest code (guest time, including guest nice).
```

## FIELD DESCRIPTION FOR DISK MODE

### Reads

```
total: Total reads completed successfully
merged: grouped reads (resulting in one I/O)
sectors: Sectors read successfully
ms: milliseconds spent reading
```

### Writes

```
total: Total writes completed successfully
merged: grouped writes (resulting in one I/O)
sectors: Sectors written successfully
ms: milliseconds spent writing
```

### IO

```
cur: I/O in progress
s: seconds spent for I/O
```

## FIELD DESCRIPTION FOR DISK PARTITION MODE

```
reads: Total number of reads issued to this partition
read sectors: Total read sectors for partition
writes : Total number of writes issued to this partition
requested writes: Total number of write requests made for partition
```

## FIELD DESCRIPTION FOR SLAB MODE
Slab mode shows statistics per slab, for more information about this information see slabinfo(5)

```
cache: Cache name
num: Number of currently active objects
total: Total number of available objects
size: Size of each object
pages: Number of pages with at least one active object
```

## NOTES
vmstat requires read access to files under /proc. The -m requires read access to /proc/slabinfo which may not be available to standard users. Mount options for /proc such as subset=pid may also impact what is visible.

## SEE ALSO
free(1), iostat(1), mpstat(1), ps(1), sar(1), top(1), slabinfo(5)

## REPORTING BUGS
Please send bug reports to procps@freelists.org.


ftpdctl

package: proftpd

title: ftpdctl(8)

summary: ProFTPD control program

text:
# ftpdctl(8)

## NAME
ftpdctl - ProFTPD control program

## SYNOPSIS
ftpdctl [ -hv ] [ -s Unix domain socket ] action action-parameters

## DESCRIPTION
ftpdctl is the control program for the Professional File Transfer Protocol (FTP) server daemon. The control program is used to control the daemon while it is running, supporting actions like restarting or shutting down the daemon, disabling or enabling specific virtual servers, kicking FTP users, etc.

The specific actions available via ftpdctl depend on the modules compiled into proftpd. Check the modules documentation for more information on the specific actions supported by the modules.

## OPTIONS
-h,--help

Display a short usage description, including all available options.

-s,--socket

Specifies an alternate path to be used for communicating with proftpd rather than the default Unix domain socket. The default controls socket is /var/run/proftpd/proftpd.sock

-v,--verbose

Display informational messages while communicating with the proftpd daemon.

## EXIT STATUS
The ftpdctl utility exits with one of the following values:

0

Requested action was successfully handled.

1

A generic error occurred handling the request.

2

The requesting user does not have permission to perform the action.

3

The request contains invalid/unknown parameters.

4

The subject/target of the requested action could not be found.

5

The requested action could not be handled.

6

The requested action/operation was ignored.

7

The requested action is not supported.

8

An internal error occurred while processing the requested action.

## AUTHORS
ProFTPD is written and maintained by a number of people, full credits can be found on http://www.proftpd.org/credits.html

## SEE ALSO
proftpd(8),ftp(1),ftpwho(1),ftpcount(1),ftpshut(8)

Full documentation on ProFTPD, including configuration and FAQs, is available at http://www.proftpd.org/

For help/support, try the ProFTPD mailing lists, detailed on http://www.proftpd.org/lists.html

Report bugs at http://bugs.proftpd.org/


ftpscrub

title: ftpscrub(8)

text:
# ftpscrub(8)

## NAME
ftpscrub - scrub the proftpd scoreboard file of stale entries

## SYNOPSIS
ftpscrub

## DESCRIPTION
The ftpscrub command provides a way to scrub the scoreboard file on demand, at times which suit the site best. This should be run periodically on sites which run proftpd in inetd mode.

## OPTIONS
-h,--help

Display a short usage description, including all available options.

-f,--file scoreboard-file

Specify the full path to proftpd's run-time scoreboard file (configured via the ScoreboardFile directive in proftpd.conf ). If proftpd's default directory has been changed via this directive, ftpscrub must either be recompiled, or this option must be used in order to find proftpd's scoreboard.

-v,--verbose

Reports additional information while scrubbing the scoreboard.

## FILES
/usr/sbin/ftpscrub

/var/run/proftpd/proftpd.scoreboard

## AUTHORS
ProFTPD is written and maintained by a number of people, full credits can be found on http://www.proftpd.org/credits.html

## SEE ALSO
inetd(8),ftp(1),proftpd(8),ftpwho(1),ftpcount(1)

Full documentation on ProFTPD, including configuration and FAQs, is available at http://www.proftpd.org/

For help/support, try the ProFTPD mailing lists, detailed on http://www.proftpd.org/lists.html

Report bugs at http://bugs.proftpd.org/


ftpshut

title: ftpshut(8)

text:
# ftpshut(8)

## NAME
ftpshut - shut down all proftpd servers at a given time

## SYNOPSIS
ftpshut [ -R ] [ -l min ] [ -d min ] time [ warning-message ]

## DESCRIPTION
The ftpshut command provides an automated shutdown procedure that a superuser can use to automagically disconnect current proftpd connections, and deny new connections. The command creates a control file as /etc/shutmsg to inform proftpd processes about an impending shutdown.

## OPTIONS
time

The time at which the ftp servers will be brought down. It may be the word `now', indicating an immediate shutdown, or a future time in one of two formats: +number or HHMM. The first form brings the servers down in number minutes, while the second form indicates an exact time of day, using a 24-hour clock format.

-R

Instructs ftpshut to remove the /etc/shutmsg file, restoring proftpd to its normal service. If this option is used, this will be the only operation performed by ftpshut

-l min

Specifies the number of minutes before shutdown that new ftp access will be disabled. If the -l option is not specified, a default of 10 minutes (or immediately, if less than 10 minutes remains until shutdown) is used.

-d min

Specifies the number of minutes before shutdown that existing ftp connections will be disconnected. If the -d option is not specified, a default of 5 minutes (or immediately, if less than 5 minutes remains until shutdown) is used.

warning-message

Optionally provide a message which will be sent to new connections (if denied) and existing connections (when disconnected). The message can contain the following magic cookies, which will be replaced as follows before being sent to new or existing connections:

%s

time proftpd is being shut down

%r

time new connections will be denied

%d

time current connections will be dropped

%C

current working directory (where applicable)

%L

local host name (or virtualhost name)

%R

remote host name

%T

local time (format Thu Nov 15 17:12:42 1990)

%U

username given at login time

## CAVEATS
Proftpd servers can only be shutdown via ftpshut if a master daemon is running in standalone mode. Servers running in inetd mode will honor the shutdown message file created by ftpshut, however currently running servers may be chroot(2)ed, and unable to read the shutdown message control file.

It is possible to set an absolute shutdown time which is earlier than the current time. If this is the case, proftpd will not shutdown until the indicated time on the following day.

## FILES
/usr/sbin/ftpshut

/etc/shutmsg

## AUTHORS
ProFTPD is written and maintained by a number of people, full credits can be found on http://www.proftpd.org/credits.html

## SEE ALSO
inetd(8),ftp(1),proftpd(8),ftpwho(1),ftpcount(1)

Full documentation on ProFTPD, including configuration and FAQs, is available at http://www.proftpd.org/

For help/support, try the ProFTPD mailing lists, detailed on http://www.proftpd.org/lists.html

Report bugs at http://bugs.proftpd.org/


proftpd

title: proftpd(8)

text:
# proftpd(8)

## NAME
proftpd - Professional configurable, secure file transfer protocol server

## SYNOPSIS
proftpd [ -hlntv ] [ -c config-file ] [ -d debuglevel ] [ -p 0|1 ]

## DESCRIPTION
proftpd is the Professional File Transfer Protocol (FTP) server daemon. The server may be invoked by the Internet "super-server" inetd(8) each time a connection to the FTP service is made, or alternatively it can be run as a standalone daemon.

Each successful and failed ftp(1) session is logged using syslog with a facility of LOG_FTP. Note: LOG_FTP messages are not displayed by syslogd(8) by default, and may have to be enabled in syslogd(8)'s configuration file.

When proftpd is run in standalone mode and it receives a SIGHUP then it will reread its configuration file. When run in standalone mode without the -n option, the main proftpd daemon writes its process ID to /var/run/proftpd/proftpd.pid to make it easy to know which process to SIGHUP.

## OPTIONS
-h,--help

Display a short usage description, including all available options.

-n,--nodaemon

Runs the proftpd process in standalone mode (must be configured as such in the configuration file), but does not background the process or disassociate it from the controlling tty. Additionally, all output (log or debug messages) are sent to stderr, rather than the syslog mechanism. Most often used with the -d option for debugging.

-q,--quiet

Quiet mode; don't send logging information to standard error when running with the -n option. Logs are directed to the configured log output (syslog or logfile) instead.

-v,--version

Displays the version number of ProFTPD to stdout.

-D,--define parameter

Sets a configuration parameter which can be used <IfDefine>...</IfDefine> sections in the configuration files to conditionally skip or process commands.

-d,--debug debuglevel

Sets proftpd's internal debug level (normally 0). The debuglevel should be an integer value from 0 to 10, with higher numbers producing more debug output. Normally, debug messages are sent to syslog using the DEBUG facility, however if the -n option is used, all such output is sent to stderr.

-c,--config config-file

Specifies an alternate config-file to be parsed at startup, rather than the default configuration file. The default configuration file is /etc/proftpd.conf

-N,--nocollision

Disables address/port collision checking.

-S,--serveraddr

Specifies an IP address for the host machine, avoiding an DNS lookup of the hostname

-t,--configtest

Read the configuration file, report any syntax errors, and exit.

-p,--persistent 0|1

Disables (0) or enables (1) the default persistent password support, which is determined at configure time for each platform. This option only affects the default support, it can still be overridden at run-time with the PersistentPasswd directive.

-l,--list

Lists all modules compiled into proftpd.

-V,--settings

Displays various compile-time settings and exits.

-X,--nofork

Debug mode (do not fork a session process); exits after one session.

-4,--ipv4

Support IPv4 functionality only, regardless of whether the --enable-ipv6 configure option was used.

-6,--ipv6

Support IPv6 connections and lookup of IPv6 addresses for server DNS names. This is enabled by default, if the --enable-ipv6 configure option is used.

## FILES
/usr/sbin/proftpd

/etc/proftpd.conf

/usr/bin/ftpwho

/usr/bin/ftpcount

/usr/bin/ftptop

/usr/sbin/ftpshut

/etc/ftpusers

/var/log/xferlog

/var/run/proftpd/proftpd.pid

/var/run/proftpd/proftpd.scoreboard

## AUTHORS
ProFTPD is written and maintained by a number of people, full credits can be found on http://www.proftpd.org/credits.html

## SEE ALSO
proftpd.conf(5),inetd(8),ftp(1),ftpwho(1),ftpcount(1),ftpshut(8)

Full documentation on ProFTPD, including configuration and FAQs, is available at http://www.proftpd.org/

For help/support, try the ProFTPD mailing lists, detailed on http://www.proftpd.org/lists.html

Report bugs at http://bugs.proftpd.org/


lei-daemon

package: public-inbox

title: lei-daemon(8)

text:
# lei-daemon(8)

## NAME
lei-daemon - technical information for local email interface daemon

## DESCRIPTION
This documentation is a high-level overview for developers and administrators interested in how lei works.

lei-daemon is a background daemon which powers the lei(1) command-line tool. It may support virtual users and read-write IMAP+JMAP APIs in the future. It is designed to optimize shell completion by avoiding module loading costs, monitor Maildirs (and in the near future, IMAP folders) for changes.

### worker processes
Most commands cause lei-daemon to fork(2) new worker processes to isolate and parallelize work. lei-daemon is significantly more aggressive than read-only public-inbox-daemon(8) processes with regards to resource use since it's not designed to support C10K/C100K scenarios.

### file descriptor passing
FD passing is used to reduce IPC costs for bulk I/O when importing large mboxes from stdin and dumping large mboxes to stdout.

### SOCK_SEQPACKET
SOCK_SEQPACKET sockets are used for both communicating with lei(1) and to internal workers. SOCK_SEQPACKET guarantees reliability (unlike SOCK_DGRAM), allows easy load distribution, and saves developers the trouble of maintaining stream parsers.

### file monitoring
Inotify or EVFILT_VNODE is used depending on the platform to monitor Maildirs for changes and track keyword changes.

The listen socket (default: "$XDG_RUNTIME_DIR/lei/5.seq.sock") is also monitored, and the daemon will automatically shutdown if it is unlinked.

## CONTACT
Feedback welcome via plain-text mail to <mailto:meta@public-inbox.org>

The mail archives are hosted at <https://public-inbox.org/meta/> and <http://4uok3hntl7oi7b4uf4rtfwefqeexfzil2w6kgk2jn5z2f764irre7byd.onion/meta/>

## COPYRIGHT
Copyright all contributors <mailto:meta@public-inbox.org>

License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>

## SEE ALSO
lei-overview(7), lei-daemon-kill(1), lei-daemon-pid(1)


public-inbox-daemon

title: public-inbox-daemon(8)

summary: common usage for public\-inbox network daemons

text:
# public-inbox-daemon(8)

## NAME
public-inbox-daemon - common usage for public-inbox network daemons

## SYNOPSIS

```
        public-inbox-netd
        public-inbox-httpd
        public-inbox-imapd
        public-inbox-nntpd
        public-inbox-pop3d
```

## DESCRIPTION
This manual describes common options and behavior for public-inbox network daemons. Network daemons for public-inbox provide read-only IMAP, HTTP, NNTP and POP3 access to public-inboxes. Write access to a public-inbox will never be required to run these.

These daemons are implemented with a common core using non-blocking sockets and optimized for fairness; even with thousands of connected clients over slow links.

They also provide graceful shutdown/upgrade support to avoid breaking existing connections during software upgrades.

These daemons may also utilize multiple pre-forked worker processes to take advantage of multiple CPUs.

## OPTIONS
-l [PROTOCOL://]ADDRESS[?opt1=val1,opt2=val2]

--listen [PROTOCOL://]ADDRESS[?opt1=val1,opt2=val2]

This takes an absolute path to a Unix socket or HOST:PORT to listen on. For example, to listen to TCP connections on port 119, use: "-l 0.0.0.0:119". This may also point to a Unix socket ("-l /path/to/http.sock") for a reverse proxy like nginx(8) to use. May be specified multiple times to allow listening on multiple sockets.

Unless per-listener options are used (required for public-inbox-netd(1)), this does not need to be specified at all if relying on systemd.socket(5) or similar,

Per-listener options may be specified after "?" as "KEY=VALUE" pairs delimited by ",". See public-inbox-netd(1) for documentation on the "cert=", "key=", "env.NAME=VALUE", "out=", "err=", and "psgi=" options available.

Default: server-dependent unless socket activation is used with systemd(1) or similar (see systemd.socket(5)).

-1

--stdout PATH

Specify an appendable path to redirect stdout descriptor (1) to. Using this is preferable to setting up the redirect externally (e.g. >>/path/to/log in shell) since it allows SIGUSR1 to be handled (see "SIGNALS" in SIGNALS below). "out=" may also be specified on a per-listener basis.

Default: /dev/null with "--daemonize", inherited otherwise

-2 PATH

--stderr PATH

Like "--stdout", but for the stderr descriptor (2). "err=" may also be specified on a per-listener basis.

Default: /dev/null with "--daemonize", inherited otherwise

-W

--worker-processes

Set the number of worker processes. Normally, this should match the number of CPUs on the system to take full advantage of the hardware. However, users of memory-constrained systems may want to lower this.

Setting this to zero ("-W0") disables the master/worker split; saving some memory but removing the ability to use SIGTTIN to increase worker processes or have the worker restarted by the master on crashes.

Default: 1

--cert /path/to/cert

The default TLS certificate for HTTPS, IMAPS, NNTPS, POP3S and/or STARTTLS support if the "cert" option is not given with "--listen". With this option, well-known TCP ports automatically get TLS or STARTTLS support if using systemd-compatible socket activation. That is, ports 443, 563, 993, and 995 support HTTPS, NNTPS, IMAPS, and POP3S, respectively; while ports 110, 119, and 143 support STARTTLS on POP3, NNTP, and IMAP, respectively.

--key /path/to/key

The default TLS certificate key for the default "--cert" or per-listener "cert=" option. The private key may be concatenated into the cert file itself, in which case this option is not needed.

--multi-accept INTEGER

By default, each worker accepts one connection at a time to maximize fairness and minimize contention across multiple processes on a shared listen socket. Accepting multiple connections at once may be useful in constrained deployments with few, heavily loaded workers. Negative values enables a worker to accept all available clients at once, possibly starving others in the process. -1 behaves like "multi_accept yes" in nginx; while 0 (the default) is "multi_accept no" in nginx. Positive values allow fine-tuning without the runaway behavior of -1. This may be specified on a per-listener basis via the "multi-accept=" per-listener directive (e.g. "-l http://127.0.0.1?multi-accept=1").

Default: 0

## SIGNALS
Most of our signal handling behavior is copied from nginx(8) and/or starman(1), so it is possible to reuse common scripts for managing them.

SIGUSR1

Reopens log files pointed to by --stdout and --stderr options.

SIGUSR2

Spawn a new process with the intention to replace the running one. See "UPGRADING" below.

SIGHUP

Reload config files associated with the process. (Note: broken for public-inbox-httpd(1) only in <= 1.6)

SIGTTIN

Increase the number of running worker processes by one.

SIGTTOU

Decrease the number of running worker processes by one.

SIGWINCH

Stop all running worker processes. SIGHUP or SIGTTIN may be used to restart workers.

SIGQUIT

Gracefully terminate the running process.

SIGTTOU, SIGTTIN, SIGWINCH all have no effect when worker processes are disabled with "-W0" on the command-line.

## ENVIRONMENT
PI_CONFIG

The default config file, normally "~/.public-inbox/config". See public-inbox-config(5)

LISTEN_FDS, LISTEN_PID

Used by systemd (and compatible) installations for socket activation. See systemd.socket(5) and sd_listen_fds(3).

PERL_INLINE_DIRECTORY

Pointing this to a writable directory enables the use of Inline and Inline::C extensions which may provide platform-specific performance improvements. Currently, this enables the use of vfork(2) which speeds up subprocess spawning with the Linux kernel. public-inbox will never enable Inline::C automatically without this environment variable set or "~/.cache/public-inbox/inline-c" created by a user. See Inline and Inline::C for more details.

## UPGRADING
There are two ways to upgrade a running process.

Users of process management systems with socket activation (systemd(1) or similar) may rely on multiple daemon instances. For systemd, this means using two (or more) '@' instances for each service (e.g. "SERVICENAME@INSTANCE") as documented in systemd.unit(5).

Users of traditional SysV init may use SIGUSR2 to spawn a replacement process and gracefully terminate the old process using SIGQUIT.

In either case, the old process will not truncate running responses; so responses to expensive requests do not get interrupted and lost.

## CONTACT
Feedback welcome via plain-text mail to <mailto:meta@public-inbox.org>

The mail archives are hosted at <https://public-inbox.org/meta/> and <http://4uok3hntl7oi7b4uf4rtfwefqeexfzil2w6kgk2jn5z2f764irre7byd.onion/meta/>

## COPYRIGHT
Copyright all contributors <mailto:meta@public-inbox.org>

License: AGPL-3.0+ <https://www.gnu.org/licenses/agpl-3.0.txt>

## SEE ALSO
public-inbox-httpd(1), public-inbox-imapd(1), public-inbox-nntpd(1), public-inbox-pop3d(1), public-inbox-netd(1)


puppet

package: puppet

title: puppet(8)

text:
# puppet(8)

## NAME
puppet - an automated configuration management tool

## SYNOPSIS
puppet subcommand [options] action [options]

## DESCRIPTION
Puppet, an automated administrative engine for your Linux, Unix, and Windows systems, performs administrative tasks (such as adding users, installing packages, and updating server configurations) based on a centralized specification.

## COMMANDS

### Common
apply

Apply Puppet manifests locally

agent

The puppet agent daemon

config

Interact with Puppet´s settings.

help

Display Puppet help.

lookup

Interactive Hiera lookup

module

Creates, installs and searches for modules on the Puppet Forge.

resource

The resource abstraction layer shell

### Specialized
strings

Generate Puppet documentation with YARD.

catalog

Compile, save, view, and convert catalogs.

describe

Display help about resource types

device

Manage remote network devices

doc

Generate Puppet references

epp

Interact directly with the EPP template parser/renderer.

facts

Retrieve and store facts.

filebucket

Store and retrieve files in a filebucket

generate

Generates Puppet code from Ruby definitions.

node

View and manage node definitions.

parser

Interact directly with the parser.

plugin

Interact with the Puppet plugin system.

script

Run a puppet manifests as a script without compiling a catalog

ssl

Manage SSL keys and certificates for puppet SSL clients

## SEE ALSO
See puppet help <subcommand> for help on a specific subcommand.

See puppet help <subcommand> <action> for help on a specific subcommand action.


puppet-agent

title: puppet-agent(8)

summary: The puppet agent daemon

text:
# puppet-agent(8)

## NAME
puppet-agent - The puppet agent daemon

## SYNOPSIS
Retrieves the client configuration from the Puppet master and applies it to the local host.

This service may be run as a daemon, run periodically using cron (or something similar), or run interactively for testing purposes.

## USAGE
puppet agent [--certname NAME] [-D|--daemonize|--no-daemonize] [-d|--debug] [--detailed-exitcodes] [--digest DIGEST] [--disable [MESSAGE]] [--enable] [--fingerprint] [-h|--help] [-l|--logdest syslog|eventlog|ABS FILEPATH|console] [--serverport PORT] [--noop] [-o|--onetime] [--sourceaddress IP_ADDRESS] [-t|--test] [-v|--verbose] [-V|--version] [-w|--waitforcert SECONDS]

## DESCRIPTION
This is the main puppet client. Its job is to retrieve the local machine´s configuration from a remote server and apply it. In order to successfully communicate with the remote server, the client must have a certificate signed by a certificate authority that the server trusts; the recommended method for this, at the moment, is to run a certificate authority as part of the puppet server (which is the default). The client will connect and request a signed certificate, and will continue connecting until it receives one.

Once the client has a signed certificate, it will retrieve its configuration and apply it.

## USAGE NOTES
´puppet agent´ does its best to find a compromise between interactive use and daemon use. If you run it with no arguments and no configuration, it goes into the background, attempts to get a signed certificate, and retrieves and applies its configuration every 30 minutes.

Some flags are meant specifically for interactive use --- in particular, ´test´, ´tags´ and ´fingerprint´ are useful.

´--test´ runs once in the foreground with verbose logging, then exits. It also exits if it can´t get a valid catalog. --test includes the ´--detailed-exitcodes´ option by default and exits with one of the following exit codes:

- 0: The run succeeded with no changes or failures; the system was already in the desired state.

- 1: The run failed, or wasn´t attempted due to another run already in progress.

- 2: The run succeeded, and some resources were changed.

- 4: The run succeeded, and some resources failed.

- 6: The run succeeded, and included both changes and failures.

´--tags´ allows you to specify what portions of a configuration you want to apply. Puppet elements are tagged with all of the class or definition names that contain them, and you can use the ´tags´ flag to specify one of these names, causing only configuration elements contained within that class or definition to be applied. This is very useful when you are testing new configurations --- for instance, if you are just starting to manage ´ntpd´, you would put all of the new elements into an ´ntpd´ class, and call puppet with ´--tags ntpd´, which would only apply that small portion of the configuration during your testing, rather than applying the whole thing.

´--fingerprint´ is a one-time flag. In this mode ´puppet agent´ runs once and displays on the console (and in the log) the current certificate (or certificate request) fingerprint. Providing the ´--digest´ option allows you to use a different digest algorithm to generate the fingerprint. The main use is to verify that before signing a certificate request on the master, the certificate request the master received is the same as the one the client sent (to prevent against man-in-the-middle attacks when signing certificates).

´--skip_tags´ is a flag used to filter resources. If this is set, then only resources not tagged with the specified tags will be applied. Values must be comma-separated.

## OPTIONS
Note that any Puppet setting that´s valid in the configuration file is also a valid long argument. For example, ´server´ is a valid setting, so you can specify ´--server servername´ as an argument. Boolean settings accept a ´--no-´ prefix to turn off a behavior, translating into ´--setting´ and ´--no-setting´ pairs, such as --daemonize and --no-daemonize.

See the configuration file documentation at https://puppet.com/docs/puppet/latest/configuration.html for the full list of acceptable settings. A commented list of all settings can also be generated by running puppet agent with ´--genconfig´.

- --certname: Set the certname (unique ID) of the client. The master reads this unique identifying string, which is usually set to the node´s fully-qualified domain name, to determine which configurations the node will receive. Use this option to debug setup problems or implement unusual node identification schemes. (This is a Puppet setting, and can go in puppet.conf.)

- --daemonize: Send the process into the background. This is the default. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --no-daemonize: Do not send the process into the background. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --debug: Enable full debugging.

- --detailed-exitcodes: Provide extra information about the run via exit codes; works only if ´--test´ or ´--onetime´ is also specified. If enabled, ´puppet agent´ uses the following exit codes:

0: The run succeeded with no changes or failures; the system was already in the desired state.

1: The run failed, or wasn´t attempted due to another run already in progress.

2: The run succeeded, and some resources were changed.

4: The run succeeded, and some resources failed.

6: The run succeeded, and included both changes and failures.

- --digest: Change the certificate fingerprinting digest algorithm. The default is SHA256. Valid values depends on the version of OpenSSL installed, but will likely contain MD5, MD2, SHA1 and SHA256.

- --disable: Disable working on the local system. This puts a lock file in place, causing ´puppet agent´ not to work on the system until the lock file is removed. This is useful if you are testing a configuration and do not want the central configuration to override the local state until everything is tested and committed.

Disable can also take an optional message that will be reported by the ´puppet agent´ at the next disabled run.

´puppet agent´ uses the same lock file while it is running, so no more than one ´puppet agent´ process is working at a time.

´puppet agent´ exits after executing this.

•

--enable: Enable working on the local system. This removes any lock file, causing ´puppet agent´ to start managing the local system again However, it continues to use its normal scheduling, so it might not start for another half hour.

´puppet agent´ exits after executing this.

- --evaltrace: Logs each resource as it is being evaluated. This allows you to interactively see exactly what is being done. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --fingerprint: Display the current certificate or certificate signing request fingerprint and then exit. Use the ´--digest´ option to change the digest algorithm used.

- --help: Print this help message

- --job-id: Attach the specified job id to the catalog request and the report used for this agent run. This option only works when ´--onetime´ is used. When using Puppet Enterprise this flag should not be used as the orchestrator sets the job-id for you and it must be unique.

- --logdest: Where to send log messages. Choose between ´syslog´ (the POSIX syslog service), ´eventlog´ (the Windows Event Log), ´console´, or the path to a log file. If debugging or verbosity is enabled, this defaults to ´console´. Otherwise, it defaults to ´syslog´ on POSIX systems and ´eventlog´ on Windows. Multiple destinations can be set using a comma separated list (eg: /path/file1,console,/path/file2)"

A path ending with ´.json´ will receive structured output in JSON format. The log file will not have an ending ´]´ automatically written to it due to the appending nature of logging. It must be appended manually to make the content valid JSON.

A path ending with ´.jsonl´ will receive structured output in JSON Lines format.

- --masterport: The port on which to contact the Puppet Server. (This is a Puppet setting, and can go in puppet.conf. Deprecated in favor of the ´serverport´ setting.)

- --noop: Use ´noop´ mode where the daemon runs in a no-op or dry-run mode. This is useful for seeing what changes Puppet would make without actually executing the changes. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --onetime: Run the configuration once. Runs a single (normally daemonized) Puppet run. Useful for interactively running puppet agent when used in conjunction with the --no-daemonize option. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --serverport: The port on which to contact the Puppet Server. (This is a Puppet setting, and can go in puppet.conf.)

- --sourceaddress: Set the source IP address for transactions. This defaults to automatically selected. (This is a Puppet setting, and can go in puppet.conf.)

- --test: Enable the most common options used for testing. These are ´onetime´, ´verbose´, ´no-daemonize´, ´no-usecacheonfailure´, ´detailed-exitcodes´, ´no-splay´, and ´show_diff´.

- --trace Prints stack traces on some errors. (This is a Puppet setting, and can go in puppet.conf. Note the special ´no-´ prefix for boolean settings on the command line.)

- --verbose: Turn on verbose reporting.

- --version: Print the puppet version number and exit.

- --waitforcert: This option only matters for daemons that do not yet have certificates and it is enabled by default, with a value of 120 (seconds). This causes ´puppet agent´ to connect to the server every 2 minutes and ask it to sign a certificate request. This is useful for the initial setup of a puppet client. You can turn off waiting for certificates by specifying a time of 0. (This is a Puppet setting, and can go in puppet.conf.)

- --write_catalog_summary After compiling the catalog saves the resource list and classes list to the node in the state directory named classes.txt and resources.txt (This is a Puppet setting, and can go in puppet.conf.)

## EXAMPLE

```
$ puppet agent --server puppet.domain.com
```

## DIAGNOSTICS
Puppet agent accepts the following signals:

SIGHUP

Restart the puppet agent daemon.

SIGINT and SIGTERM

Shut down the puppet agent daemon.

SIGUSR1

Immediately retrieve and apply configurations from the puppet master.

SIGUSR2

Close file descriptors for log files and reopen them. Used with logrotate.

## AUTHOR
Luke Kanies

## COPYRIGHT
Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License


puppet-apply

title: puppet-apply(8)

summary: Apply Puppet manifests locally

text:
# puppet-apply(8)

## NAME
puppet-apply - Apply Puppet manifests locally

## SYNOPSIS
Applies a standalone Puppet manifest to the local system.

## USAGE
puppet apply [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose] [-e|--execute] [--detailed-exitcodes] [-L|--loadclasses] [-l|--logdest syslog|eventlog|ABS FILEPATH|console] [--noop] [--catalog catalog] [--write-catalog-summary] file

## DESCRIPTION
This is the standalone puppet execution tool; use it to apply individual manifests.

When provided with a modulepath, via command line or config file, puppet apply can effectively mimic the catalog that would be served by puppet master with access to the same modules, although there are some subtle differences. When combined with scheduling and an automated system for pushing manifests, this can be used to implement a serverless Puppet site.

Most users should use ´puppet agent´ and ´puppet master´ for site-wide manifests.

## OPTIONS
Any setting that´s valid in the configuration file is a valid long argument for puppet apply. For example, ´tags´ is a valid setting, so you can specify ´--tags class,tag´ as an argument.

See the configuration file documentation at https://puppet.com/docs/puppet/latest/configuration.html for the full list of acceptable parameters. You can generate a commented list of all configuration options by running puppet with ´--genconfig´.

- --debug: Enable full debugging.

- --detailed-exitcodes: Provide extra information about the run via exit codes. If enabled, ´puppet apply´ will use the following exit codes:

0: The run succeeded with no changes or failures; the system was already in the desired state.

1: The run failed.

2: The run succeeded, and some resources were changed.

4: The run succeeded, and some resources failed.

6: The run succeeded, and included both changes and failures.

- --help: Print this help message

- --loadclasses: Load any stored classes. ´puppet agent´ caches configured classes (usually at /etc/puppetlabs/puppet/classes.txt), and setting this option causes all of those classes to be set in your puppet manifest.

- --logdest: Where to send log messages. Choose between ´syslog´ (the POSIX syslog service), ´eventlog´ (the Windows Event Log), ´console´, or the path to a log file. Defaults to ´console´. Multiple destinations can be set using a comma separated list (eg: /path/file1,console,/path/file2)"

A path ending with ´.json´ will receive structured output in JSON format. The log file will not have an ending ´]´ automatically written to it due to the appending nature of logging. It must be appended manually to make the content valid JSON.

A path ending with ´.jsonl´ will receive structured output in JSON Lines format.

- --noop: Use ´noop´ mode where Puppet runs in a no-op or dry-run mode. This is useful for seeing what changes Puppet will make without actually executing the changes.

- --execute: Execute a specific piece of Puppet code

- --test: Enable the most common options used for testing. These are ´verbose´, ´detailed-exitcodes´ and ´show_diff´.

- --verbose: Print extra information.

- --catalog: Apply a JSON catalog (such as one generated with ´puppet master --compile´). You can either specify a JSON file or pipe in JSON from standard input.

- --write-catalog-summary After compiling the catalog saves the resource list and classes list to the node in the state directory named classes.txt and resources.txt

## EXAMPLE

```
$ puppet apply -e ´notify { "hello world": }´
$ puppet apply -l /tmp/manifest.log manifest.pp
$ puppet apply --modulepath=/root/dev/modules -e "include ntpd::server"
$ puppet apply --catalog catalog.json
```

## AUTHOR
Luke Kanies

## COPYRIGHT
Copyright (c) 2011 Puppet Inc., LLC Licensed under the Apache 2.0 License