title: pam_pkcs11(8)

text:
# pam_pkcs11(8)

## NAME
pam_pkcs11 - PAM Authentication Module for PKCS#11 token libraries

## SYNOPSIS
pam_pkcs11.so [debug] [configfile=<configfile>]

## DESCRIPTION
This Linux-PAM login module allows a X.509 certificate based user login. The certificate and its dedicated private key are thereby accessed by means of an appropriate PKCS #11 module. For the verification of the users' certificates, locally stored CA certificates as well as either online or locally accessible CRLs are used.

## CONFIGURATION
The program that needs a PAM service should be configured in /etc/pam.conf or /etc/pam.d/<servicename>.

pam_pkcs11 can be used in the <auth> PAM chain.

For details on how to configure PAM services, see the PAM documentation for your system. This manual does not cover PAM configuration details. The existing PAM service definitions for other applications on your system is also a good source for examples on how to configure a PAM service.

## FILES
/etc/security/pam_pkcs11/pam_pkcs11.conf

/usr/lib64/pam_pkcs11/*_mapper.so

## AUTHOR
Original PAM-pkcs11 was written by Mario Strasser <mast@gmx.net>. Newer versions are from Juan Antonio Martinez <jonsito@teleline.es>.

## REPORTING BUGS
Report bugs ideas, comments, bug-fixes and so to: Juan Antonio Martinez <jonsito@teleline.es>

## SEE ALSO
pam(8), pam_pkcs11.conf(5), PAM Systems Administrator Guide, README.mappers file, PAM-PKCS#11 User Manual.


title: pam_snapper(8)

summary: PAM module which creates filesystem snapshots via snapper

text:
# pam_snapper(8)

## NAME
pam_snapper - PAM module which creates filesystem snapshots via "snapper"

## SYNOPSIS
pam_snapper.so [debug] [homeprefix=prefix] [ignoreservices=services] [ignoreusers=users] [rootasroot] [ignoreroot] [openonly] [closeonly] [cleanup=algorithm]

## DESCRIPTION
Create a snapshot at every login of a user, thus they always have a save starting point.

As many users do not logout for some time, it is a good idea to enable snapper's time based snapshots in addition.

## OPTIONS
debug

Switch on debugging in the module.

homeprefix=prefix

Prefix for the name of the snapper configuration. The username will be appended to this prefix. Default: "home_"

ignoreservices=comma separated list of services

Default: "crond"

ignoreusers=comma separated list of users

Default: (none)

rootasroot

Perform a snapshot using the snapper configuration "root" if the user "root" logs in. In other words: the homeprefix is not used in this case. As the snapper configuration "root" is used for the system (the root filesystem), this means that with every login of the user "root" the complete "/" filesystem will be snapshotted. This can be useful to help administrators rolling back in case their activity / configuration changes have been accidentally wrong. "rootasroot" and "ignoreroot" are mutually exclusive.

ignoreroot

No snapshot is taken, if the user "root" opens/closes a session. "rootasroot" and "ignoreroot" are mutually exclusive.

openonly

Only create a single snapshot when opening the PAM session. Default: create pre- and post-snapshots

closeonly

Only create a single snapshot when closing the PAM session. Default: create pre- and post-snapshots

cleanup=cleanup-algorithm

Set snapper cleanup algorithm. Default: (none)

## MODULE TYPES PROVIDED
Only the module type "session" is provided.

## RETURN VALUES
PAM_SUCCESS

pam_snapper will always return PAM_SUCCESS, to not prevent users from login, in case a snapshot fails. This may change in the future.

## EXAMPLES

### Basic usage
1.Create a btrfs subvolume for the new user and a snapper configuration, e.g. using the tool /usr/lib/pam_snapper/pam_snapper_useradd.sh.

2.Add the following line to /etc/pam.d/common-session:

```
session    optional    pam_snapper.so

```

## SEE ALSO
snapper(8), pam.conf(5), pam(8), pam_snapper_homeconvert, pam_snapper_pamconfig, pam_snapper_useradd, pam_snapper_userdel

## HOMEPAGE
http://snapper.io/

## AUTHORS
pam-snapper was written by Matthias G. Eckermann <mge@suse.com> as part of SUSE Hackweek#9 in April 2013.

This module would not have been possible without the work of Arvin Schnell on the snapper project. pam-snapper inherits DBUS handling from "snapper_dbus_cli.c" by David Disseldorp.

The module builds on the Linux PAM stack and its documentation, written by Thorsten Kukuk.

## LICENSE
Copyright (c) 2013 SUSE

All Rights Reserved.

This program is free software; you can redistribute it and/or modify it under the terms of version 2 of the GNU General Public License as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, contact SUSE.

To contact SUSE about this file by physical or electronic mail, you may find current contact information at www.suse.com.

branch: sisyphus


title: pam_systemd(8)

text:
# pam_systemd(8)

## NAME
pam_systemd - Register user sessions in the systemd login manager

## SYNOPSIS
pam_systemd.so

## DESCRIPTION
pam_systemd registers user sessions with the systemd login manager systemd-logind.service(8), and hence the systemd control group hierarchy.

The module also applies various resource management and runtime parameters to the new session, as configured in the JSON User Records[1] of the user, when one is defined.

On login, this module — in conjunction with systemd-logind.service — ensures the following:

1.If it does not exist yet, the user runtime directory /run/user/$UID is either created or mounted as new "tmpfs" file system with quota applied, and its ownership changed to the user that is logging in.

2.The $XDG_SESSION_ID environment variable is initialized. If auditing is available and pam_loginuid.so was run before this module (which is highly recommended), the variable is initialized from the auditing session id (/proc/self/sessionid). Otherwise, an independent session counter is used.

3.A new systemd scope unit is created for the session. If this is the first concurrent session of the user, an implicit per-user slice unit below user.slice is automatically created and the scope placed into it. An instance of the system service user@.service, which runs the systemd user manager instance, is started.

4.The "$TZ", "$EMAIL" and "$LANG" environment variables are configured for the user, based on the respective data from the user's JSON record (if it is defined). Moreover, any environment variables explicitly configured in the user record are imported, and the umask, nice level, and resource limits initialized.

On logout, this module ensures the following:

1.If enabled in logind.conf(5) (KillUserProcesses=), all processes of the session are terminated. If the last concurrent session of a user ends, the user's systemd instance will be terminated too, and so will the user's slice unit.

2.If the last concurrent session of a user ends, the user runtime directory /run/user/$UID and all its contents are removed, too.

If the system was not booted up with systemd as init system, this module does nothing and immediately returns PAM_SUCCESS.

## OPTIONS
The following options are understood:

class=

Takes a string argument which sets the session class. The XDG_SESSION_CLASS environment variable (see below) takes precedence. See sd_session_get_class(3) for a way to query the class of a session. The following session classes are defined: Table 1. Session Classes

Name

Explanation

user

A regular interactive user session. This is the default class for sessions for which a TTY or X display is known at session registration time.

user-early

Similar to user but sessions of this class are not ordered after systemd-user-sessions.service(8), i.e. may be started before regular sessions are allowed to be established. This session class is the default for sessions of the root user that would otherwise qualify for the user class, see above. (Added in v256.)

user-light

Similar to user, but sessions of this class will not pull in the user@.service(5) of the user, and thus possibly have no service manager of the user running. (Added in v258.)

user-early-light

Similar to user-early, but sessions of this class will not pull in the user@.service(5) of the user, and thus possibly have no service manager of the user running. (Added in v258.)

user-incomplete

Similar to user but for sessions which are not fully set up yet, i.e. have no home directory mounted or similar. This is used by systemd-homed.service(8) to allow users to log in via ssh(1) before their home directory is mounted, delaying the mount until the user provided the unlock password. Sessions of this class are upgraded to the regular user class once the home directory is activated.

greeter

Similar to user but for sessions that are spawned by a display manager ephemerally and which prompt the user for login credentials.

lock-screen

Similar to user but for sessions that are spawned by a display manager ephemerally and which show a lock screen that can be used to unlock locked user accounts or sessions.

background

Used for background sessions, such as those invoked by cron(8) and similar tools. This is the default class for sessions for which no TTY or X display is known at session registration time.

background-light

Similar to background, but sessions of this class will not pull in the user@.service(5) of the user, and thus possibly have no service manager of the user running. (Added in v256.)

manager

The user@.service(5) service of the user is registered under this session class. (Added in v256.)

manager-early

Similar to manager, but for the root user. Compare with the user vs. user-early situation. (Added in v256.)

none

Skips registering this session with logind. No session scope will be created, and the user service manager will not be started. (Added in v258.)

Added in version 197.

type=

Takes a string argument which sets the session type. The XDG_SESSION_TYPE environment variable (see below) takes precedence. One of unspecified, tty, x11, wayland, mir, or web. See sd_session_get_type(3) for details about the session type. Added in version 209.

desktop=

Takes a single, short identifier string for the desktop environment. The XDG_SESSION_DESKTOP environment variable (see below) takes precedence. This may be used to indicate the session desktop used, where this applies and if this information is available. For example: GNOME, or KDE. It is recommended to use the same identifiers and capitalization as for $XDG_CURRENT_DESKTOP, as defined by the Desktop Entry Specification[2]. (However, note that the option only takes a single item, and not a colon-separated list like $XDG_CURRENT_DESKTOP.) See sd_session_get_desktop(3) for further details. Added in version 240.

area=

Takes a filename as parameter. If specified and the user logs into their account the $HOME environment variable will be set to ~/Areas/ suffixed by the specified string, but only if that directory exists. Moreover, the $XDG_AREA variable will be set to the (unprefixed) parameter. This functionality may be used to maintain multiple separate secondary home directories within the primary home directory of the user. Typically, the area to log into is specified while logging in, if the account permits that (accounts provided by pam_systemd_home(8) do), but this parameter may be used to define a default if that's not provided.

Note that this only adjusts $HOME during login, it does not affect the otherwise reported home directory of the user. Specifically this means that sshd(8) will continue to look for SSH keys of the user only in the primary home directory of the user, not in any of their areas.

Note that the default area to log into can also be configured as part of the user account. The area specified via area= overrides the default area configured there. Also note that if the area is specified explicitly by the user at login time, it overrides both. Also note that setting this parameter to an empty string has the effect of undoing the effect of any default area configured as part of the user record, i.e. ensuring the user logs into the primary home directory of their account.

For details on the area concept see pam_systemd_home(8).

Added in version 258.

default-capability-bounding-set=, default-capability-ambient-set=

Takes a comma-separated list of process capabilities (e.g. CAP_WAKE_ALARM, CAP_BLOCK_SUSPEND, ...) to set for the invoked session's processes, if the user record does not encode appropriate sets of capabilities directly. See capabilities(7) for details on the capabilities concept. If not specified, the default bounding set is left as is (i.e. usually contains the full set of capabilities). The default ambient set is set to CAP_WAKE_ALARM for regular users if the PAM session is associated with a local seat or if it is invoked for the systemd user service user@.service. Otherwise, defaults to the empty set. Added in version 254.

debug[=]

Takes an optional boolean argument. If yes or without the argument, the module will log debugging information as it operates.

## MODULE TYPES PROVIDED
Only session is provided.

## ENVIRONMENT
The following environment variables are initialized by the module and available to the processes of the user's session:

$XDG_SESSION_ID

A short session identifier, suitable to be used in filenames. The string itself should be considered opaque, although often it is just the audit session ID as reported by /proc/self/sessionid. Each ID will be assigned only once during machine uptime. It may hence be used to uniquely label files or other resources of this session. Combine this ID with the boot identifier, as returned by sd_id128_get_boot(3), for a globally unique identifier.

$XDG_RUNTIME_DIR

Path to a user-private user-writable directory that is bound to the user login time on the machine. It is automatically created the first time a user logs in and removed on the user's final logout. If a user logs in twice at the same time, both sessions will see the same $XDG_RUNTIME_DIR and the same contents. If a user logs in once, then logs out again, and logs in again, the directory contents will have been lost in between, but applications should not rely on this behavior and must be able to deal with stale files. To store session-private data in this directory, the user should include the value of $XDG_SESSION_ID in the filename. This directory shall be used for runtime file system objects such as AF_UNIX sockets, FIFOs, PID files and similar. It is guaranteed that this directory is local and offers the greatest possible file system feature set the operating system provides. For further details, see the XDG Base Directory Specification[3]. $XDG_RUNTIME_DIR is not set if the current user is not the original user of the session.

$TZ, $EMAIL, $LANG

If a JSON user record is known for the user logging in these variables are initialized from the respective data in the record. Added in version 245.

$SHELL_PROMPT_PREFIX, $SHELL_PROMPT_SUFFIX, $SHELL_WELCOME

These environment variables are initialized from the service credentials "shell.prompt.prefix", "shell.prompt.suffix" and "shell.welcome" if set. They are passed to the invoked session processes, where they are imported into any shell prompt (specifically $SHELL_PROMPT_PREFIX is added as prefix to $PS1, and $SHELL_PROMPT_SUFFIX as suffix) or printed on screen when a shell first initializes. Added in version 257.

The following environment variables are read by the module and may be used by the PAM service to pass metadata to the module. If these variables are not set when the PAM module is invoked but can be determined otherwise they are set by the module, so that these variables are initialized for the session and applications if known at all.

$XDG_SESSION_TYPE

The session type. This may be used instead of type= on the module parameter line, and is usually preferred. Added in version 209.

$XDG_SESSION_CLASS

The session class. This may be used instead of class= on the module parameter line, and is usually preferred. Added in version 209.

$XDG_SESSION_DESKTOP

The desktop identifier. This may be used instead of desktop= on the module parameter line, and is usually preferred. Added in version 209.

$XDG_SEAT

The seat name the session shall be registered for, if any. Added in version 209.

$XDG_VTNR

The VT number the session shall be registered for, if any. (Only applies to seats with a VT available, such as "seat0") Added in version 209.

$XDG_AREA

If an area (secondary home directories of the user, within the primary home directory) to log into has been selected this variable is set to the area name (without any path prefix). It is otherwise unset. For details about areas, see above. Added in version 258.

If not set, pam_systemd will initialize $XDG_SEAT and $XDG_VTNR based on the $DISPLAY variable (if the latter is set).

## SESSION LIMITS
PAM modules earlier in the stack, that is those that come before pam_systemd.so, can set session scope limits using the PAM context objects. The data for these objects is provided as NUL-terminated C strings and maps directly to the respective unit resource control directives. Note that these limits apply to individual sessions of the user, they do not apply to all user processes as a combined whole. In particular, the per-user user@.service unit instance, which runs the systemd --user manager process and its children, and is tracked outside of any session, being shared by all the user's sessions, is not covered by these limits.

See systemd.resource-control(5) for more information about the resources. Also, see pam_set_data(3) for additional information about how to set the context objects.

systemd.memory_max=

Sets unit MemoryMax=. Added in version 239.

systemd.tasks_max=

Sets unit TasksMax=. Added in version 239.

systemd.cpu_weight=

Sets unit CPUWeight=. Added in version 239.

systemd.io_weight=

Sets unit IOWeight=. Added in version 239.

systemd.runtime_max_sec=

Sets unit RuntimeMaxSec=. Added in version 244.

Example data as can be provided from an another PAM module:

```
pam_set_data(handle, "systemd.memory_max", (void *)"200M", cleanup);
pam_set_data(handle, "systemd.tasks_max",  (void *)"50",   cleanup);
pam_set_data(handle, "systemd.cpu_weight", (void *)"100",  cleanup);
pam_set_data(handle, "systemd.io_weight",  (void *)"340",  cleanup);
pam_set_data(handle, "systemd.runtime_max_sec", (void *)"3600", cleanup);
```

## EXAMPLE
Here's an example PAM configuration fragment that allows users sessions to be managed by systemd-logind.service:

```
#%PAM-1.0
-auth     [success=done authtok_err=bad perm_denied=bad maxtries=bad default=ignore] pam_systemd_home.so
auth      sufficient pam_unix.so
auth      required   pam_deny.so
account   required   pam_nologin.so
-account  [success=done authtok_expired=bad new_authtok_reqd=bad maxtries=bad acct_expired=bad default=ignore] pam_systemd_home.so
account   required   pam_unix.so
-password sufficient pam_systemd_home.so
password  sufficient pam_unix.so sha512 shadow try_first_pass
password  required   pam_deny.so
-session  optional   pam_keyinit.so revoke
-session  optional   pam_loginuid.so
-session  optional   pam_systemd_home.so
-session  optional   pam_systemd.so
session   required   pam_unix.so
```

## SEE ALSO
systemd(1), systemd-user-sessions.service(8), user@.service(5), systemd-logind.service(8), logind.conf(5), loginctl(1), pam_systemd_home(8), pam.conf(5), pam.d(5), pam(8), pam_loginuid(8), systemd.scope(5), systemd.slice(5), systemd.service(5)

## NOTES
1.

JSON User Records

https://systemd.io/USER_RECORD

2.

Desktop Entry Specification

https://standards.freedesktop.org/desktop-entry-spec/latest/

3.

XDG Base Directory Specification

https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html


title: pam_systemd_loadkey(8)

text:
# pam_systemd_loadkey(8)

## NAME
pam_systemd_loadkey - Read password from kernel keyring and set it as PAM authtok

## SYNOPSIS
pam_systemd_loadkey.so

## DESCRIPTION
pam_systemd_loadkey reads a NUL-separated password list from the kernel keyring, and sets the last password in the list as the PAM authtok, which can be used by e.g. pam_get_authtok(3).

The password list is supposed to be stored in the "user" keyring of the root user, by an earlier call to systemd-ask-password(1) with --keyname=. You can pass the keyname to pam_systemd_loadkey via the keyname= option.

## OPTIONS
The following options are understood:

keyname=

Takes a string argument which sets the keyname to read. The default is "cryptsetup". During boot, systemd-cryptsetup@.service(8) stores a passphrase or PIN in the keyring. The LUKS2 volume key can also be used, via the link-volume-key option in crypttab(5). Table 1. Possible values for keyname.

Value

Description

cryptsetup

Passphrase or recovery key

fido2-pin

Security token PIN

luks2-pin

LUKS2 token PIN

tpm2-pin

TPM2 PIN

Added in version 255.

debug

The module will log debugging information as it operates. Added in version 255.

## EXAMPLE
This module is intended to be used when you use LUKS with a passphrase, enable autologin in the display manager, and want to unlock Gnome Keyring / KDE KWallet automatically. So in total, you only enter one password during boot.

You need to set the password of your Gnome Keyring/KWallet to the same as your LUKS passphrase. Then add the following lines to your display manager's PAM config under /etc/pam.d/ (e.g. sddm-autologin):

```
-auth       optional    pam_systemd_loadkey.so
-auth       optional    pam_gnome_keyring.so
-session    optional    pam_gnome_keyring.so auto_start
-session    optional    pam_kwallet5.so auto_start
```

And add the following lines to your display manager's systemd service file, so it can access root's keyring:

```
[Service]
KeyringMode=inherit
```

In this setup, early during the boot process, systemd-cryptsetup@.service(8) will ask for the passphrase and store it in the kernel keyring with the keyname "cryptsetup". Then when the display manager does the autologin, pam_systemd_loadkey will read the passphrase from the kernel keyring, set it as the PAM authtok, and then pam_gnome_keyring and pam_kwallet5 will unlock with the same passphrase.


title: pam_systemd_home(8)

summary: Authenticate users and mount home directories via systemd\-homed.service

text:
# pam_systemd_home(8)

## NAME
pam_systemd_home - Authenticate users and mount home directories via systemd-homed.service

## SYNOPSIS
pam_systemd_home.so

## DESCRIPTION
pam_systemd_home ensures that home directories managed by systemd-homed.service(8) are automatically activated (mounted) on user login, and are deactivated (unmounted) when the last session of the user ends. For such users, it also provides authentication (when per-user disk encryption is used, the disk encryption key is derived from the authentication credential supplied at login time), account management (the JSON user record[1] embedded in the home store contains account details), and implements the updating of the encryption password (which is also used for user authentication).

## OPTIONS
The following options are understood:

suspend=

Takes a boolean argument. If true, the home directory of the user will be suspended automatically during system suspend; if false it will remain active. Automatic suspending of the home directory improves security substantially as secret key material is automatically removed from memory before the system is put to sleep and must be re-acquired (through user re-authentication) when coming back from suspend. It is recommended to set this parameter for all PAM applications that have support for automatically re-authenticating via PAM on system resume. If multiple sessions of the same user are open in parallel the user's home directory will be left unsuspended on system suspend as long as at least one of the sessions does not set this parameter to on. Defaults to off. Note that TTY logins generally do not support re-authentication on system resume. Re-authentication on system resume is primarily a concept implementable in graphical environments, in the form of lock screens brought up automatically when the system goes to sleep. This means that if a user concurrently uses graphical login sessions that implement the required re-authentication mechanism and console logins that do not, the home directory is not locked during suspend, due to the logic explained above. That said, it is possible to set this field for TTY logins too, ignoring the fact that TTY logins actually do not support the re-authentication mechanism. In that case the TTY sessions will appear hung until the user logs in on another virtual terminal (regardless of whether via another TTY session or graphically) which will resume the home directory and unblock the original TTY session. (Do note that lack of screen locking on TTY sessions means even though the TTY session appears hung, keypresses can still be queued into it, and the existing screen contents be read without re-authentication; this limitation is unrelated to the home directory management pam_systemd_home and systemd-homed.service implement.)

Turning this option on by default is highly recommended for all sessions, but only if the service managing these sessions correctly implements the aforementioned re-authentication. Note that the re-authentication must take place from a component running outside of the user's context, so that it does not require access to the user's home directory for operation. Traditionally, most desktop environments do not implement screen locking this way, and need to be updated accordingly.

This setting may also be controlled via the $SYSTEMD_HOME_SUSPEND environment variable (see below), which pam_systemd_home reads during initialization and sets for sessions. If both the environment variable is set and the module parameter specified the latter takes precedence.

Added in version 245.

debug[=]

Takes an optional boolean argument. If yes or without the argument, the module will log debugging information as it operates. Added in version 245.

## HOME AREA SUPPORT
Home directories managed by systemd-homed.service(8) support multiple home "areas", which are additional secondary home directories of the user within the primary home directory. An example: at login time if a user "lennart" with a home directory of /home/lennart specifies "lennart%versuch1" as account name during login, then pam_systemd_home will execute a login into "lennart" but ensure that the $HOME variable is set to /home/lennart/Areas/versuch1 instead of the usual /home/lennart.

This is particularly useful when sharing the same home directory between multiple systems (for example between a host and a VM), with the desire to share the home directory to a large degree, but still have separate session configuration in place.

Note that the default area to log into can also be encoded in the user record, and it can be specified among pam_systemd(8) configuration parameters. However, an explicit area specified at login time (via the "%" described above) overrides any such default. Also note that simply suffixing an account with "%" at login time (i.e. specifying an empty area name) has the effect of ensuring a login into the primary home directory, overriding any default area configuration via the user record or PAM.

Note that not all login mechanisms are compatible with the "%" syntax at login time. Most notably ssh(8) is not.

Note that the area directory to log into must exist for the area specification to be respected. If an area is specified during login via the "%" logic (or the other mentioned mechanisms) and it does not actually exist the request will be ignored, and the user will log into the primary home directory instead.

Typically, in order to make use of the mechanism set up an area first, like this:

```
lennart@zeta$ mkdir -p ~/Areas
lennart@zeta$ cp -av /etc/skel ~/Areas/versuch1
```

This should be enough to log into the newly created area, either via a regular terminal (using "lennart%versuch1" when prompted for a user name), or via run0(1):

```
lennart@zeta$ run0 --area=versuch1
```

## MODULE TYPES PROVIDED
The module implements all four PAM operations: auth (to allow authentication using the encrypted data), account (because users with systemd-homed.service user accounts are described in a JSON user record[1] and may be configured in more detail than in the traditional Linux user database), session (because user sessions must be tracked in order to implement automatic release when the last session of the user is gone), password (to change the encryption password — also used for user authentication — through PAM).

## ENVIRONMENT
The following environment variables are initialized by the module and available to the processes of the user's session:

$SYSTEMD_HOME=1

Indicates that the user's home directory is managed by systemd-homed.service. Added in version 245.

$SYSTEMD_HOME_SUSPEND=

Indicates whether the session has been registered with the suspend mechanism enabled or disabled (see above). The variable's value is either "0" or "1". Note that the module both reads the variable when initializing, and sets it for sessions. Added in version 246.

## EXAMPLE
Here's an example PAM configuration fragment that permits users managed by systemd-homed.service to log in:

```
#%PAM-1.0

    -auth     [success=done authtok_err=bad perm_denied=bad maxtries=bad default=ignore] pam_systemd_home.so
auth      sufficient pam_unix.so
auth      required   pam_deny.so
account   required   pam_nologin.so
-account  [success=done authtok_expired=bad new_authtok_reqd=bad maxtries=bad acct_expired=bad default=ignore] pam_systemd_home.so
account   required   pam_unix.so
-password sufficient pam_systemd_home.so
password  sufficient pam_unix.so sha512 shadow try_first_pass
password  required   pam_deny.so
-session  optional   pam_keyinit.so revoke
-session  optional   pam_loginuid.so
-session  optional   pam_systemd_home.so
-session  optional   pam_systemd.so
session   required   pam_unix.so
```

## SEE ALSO
systemd(1), systemd-homed.service(8), homed.conf(5), homectl(1), pam_systemd(8), pam.conf(5), pam.d(5), pam(8)

## NOTES
1.

JSON user record

https://systemd.io/USER_RECORD/


title: pam_u2f(8)

summary: Module for U2F authentication

text:
# pam_u2f(8)

## NAME
pam_u2f - Module for U2F authentication

## SYNOPSIS
pam_u2f [...]

## DESCRIPTION
The module provides U2F authentication against Yubikeys and other compliant authenticators.

## OPTIONS
debug

Enables debug output

debug_file

Filename to write debugging messages to. If this file is missing, nothing will be logged. This regular file has to be created by the user or must exist and be a regular file for anything getting logged to it. It is not created by pam-u2f on purpose (for security considerations). This filename may be alternatively set to "stderr" (default), "stdout", or "syslog".

origin=origin

Set the relying party ID for the FIDO authentication procedure. If no value is specified, the identifier "pam://$HOSTNAME" is used.

appid=appid

Set the application ID for the FIDO authentication procedure. If no value is specified, the same value used for origin is taken ("pam://$HOSTNAME" if also origin is not specified). This setting is only applicable for FIDO credentials created with pamu2fcfg versions v1.0.8 or earlier. Note that on v1.1.0 and v1.1.1 of pam-u2f, handling of this setting was temporarily broken if the value was not the same as the value of origin.

authfile=file

Set the location of the file that holds the mappings of user names to keyHandles and user keys. An individual (per user) file may be configured relative to the users' home dirs, e.g. ".ssh/u2f_keys". If not specified, the location defaults to $XDG_CONFIG_HOME/Yubico/u2f_keys. If $XDG_CONFIG_HOME is not set, $HOME/.config/Yubico/u2f_keys is used. The authfile format is <username>:<KeyHandle1>,<UserKey1>,<CoseType1>,<Options1>:<KeyHandle2>,<UserKey2>,<CoseType2>,<Options2>:...

expand

Enables variable expansion within the authfile path: %u is expanded to the local user name (PAM_USER) and %% is expanded to %. Unknown expansion sequences result in an authentication error. See also openasuser.

authpending_file=file

Set the location of the file that is used for touch request notifications. This file will be opened when pam-u2f starts waiting for a user to touch the FIDO authenticator, and will be closed when it no longer waits for a touch. Use inotify to listen on these events, or a more high-level tool like yubikey-touch-detector. Default value: /var/run/user/$UID/pam-u2f-authpending. Set an empty value in order to disable this functionality, like so: "authpending_file=".

nouserok

Set to enable authentication attempts to succeed even if the user trying to authenticate is not found inside authfile or if authfile is missing/malformed.

openasuser

Setuid to the authenticating user when opening the authfile. Useful when the user’s home is stored on an NFS volume mounted with the root_squash option (which maps root to nobody which will not be able to read the file). Note that after release 1.0.8 this is done by default when no global authfile (path is absolute) or XDG_CONFIG_HOME environment variable has been set.

alwaysok

Set to enable all authentication attempts to succeed (aka presentation mode).

max_devices=n_devices

Maximum number of FIDO authenticators allowed per user (default is 24). FIDO authenticators specified in the authorization mapping file that exceed this value will be ignored.

interactive

Set to prompt a message and wait before testing the presence of a FIDO authenticator. Recommended if your authenticator doesn’t have tactile trigger.

[prompt=your prompt here]

Set individual prompt message for interactive mode. Watch the square brackets around this parameter to get spaces correctly recognized by PAM.

manual

Set to drop to a manual console where challenges are printed on screen and response read from standard input. Useful for debugging and SSH sessions without FIDO support from the SSH client/server. If enabled, interactive mode becomes redundant and has no effect.

cue

Set to prompt a message to remind to touch the FIDO authenticator.

[cue_prompt=your prompt here]

Set individual prompt message for the cue option. Watch the square brackets around this parameter to get spaces correctly recognized by PAM.

nodetect

Skip detecting if a suitable FIDO authenticator is inserted before performing a full authentication. See NOTES below.

userpresence=int

If 1, require user presence during authentication. If 0, do not request user presence during authentication. If omitted, fallback to the authenticator’s default behaviour.

userverification=int

If 1, require user verification during authentication (e.g. biometrics). If 0, do not request user verification during authentication. If omitted, fallback to the authenticator’s default behaviour. If enabled, an authenticator with support for FIDO2 user verification is required.

pinverification=int

If 1, require PIN verification during authentication. If 0, do not request PIN verification during authentication. If omitted, fallback to the authenticator’s default behaviour. If enabled, an authenticator with support for a FIDO2 PIN is required.

sshformat

Use credentials produced by versions of OpenSSH that have support for FIDO authenticator. It is not possible to mix native credentials and SSH credentials. Once this option is enabled all credentials will be parsed as SSH.

conf=path/to/pam_u2f.conf

Set an alternative location for the configuration file. The supplied path must be absolute and must correspond to an existing regular file. See CONFIGURATION FILE.

## EXAMPLES
Second factor authentication deferring user verification configuration to the authorization mapping file.

```
auth required pam_u2f.so authfile=/etc/u2f_mappings cue
```

Passwordless authentication enforcing PIN verification.

```
auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=1 userverification=0
```

Passwordless authentication using built-in UV (e.g. biometrics) with a fallback to PIN.

```
auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=0 userverification=1
auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=1 userverification=0
```

## CAVEATS
By default, relative paths to the authfile will be opened as the target user, whereas absolute paths will be opened as "root". If the "XDG_CONFIG_HOME" variable is set, privileges will not be dropped unless the "openasuser" configuration setting is set.

Using pam-u2f to secure the login to a computer while storing the mapping file in an encrypted home directory, will result in the impossibility of logging into the system. The partition is decrypted after login and the mapping file can not be accessed.

## CONFIGURATION FILE
A configuration file can be used to set the default module arguments.

•The file has a name = value format, with comments starting with the # character.

•White spaces at the beginning of line, end of line, and around the = sign are ignored.

•Any conf argument in the configuration file is ignored.

•The maximum size for the configuration file is 4 KiB.

•The default path for the configuration file is /etc/security/pam_u2f.conf. The default file is allowed to not exist. An alternative path may be set in the module command line options.

•The options specified on the module command line override the values from the configuration file.

## NOTES
Nodetect

The "nodetect" option should be used with caution. pam_u2f checks that a key configured for the user is inserted before performing the full tactile authentication. This detection is done by sending a "check-only" authentication request to all inserted tokens to so see if at least one of them responds affirmatively to one or more of the keyhandles configured for the user. By doing this, pam_u2f can avoid emitting the "cue" prompt (if configured), which can cause some confusing UI issues if the cue is emitted followed by the underlying library immediately failing the tactile authentication. This option is also useful to avoid an unintended 1-second delay prior to the tactile authentication caused by versions of libu2f-host <= 1.1.5.

If pam_u2f is configured to "cue" and "nodetect", an attacker can determine that pam_u2f is part of the authentication stack by inserting any random U2F token and performing an authentication attempt. In this scenario, the attacker would see the cue message followed by an immediate failure, whereas with detection enabled, the authentication will fail silently. Understand that an attacker could choose an authenticator that alerts him or her in some way to the "check-only" authentication attempt, so this precaution only pushes the issue back a step.

In summary, the detection feature was added to avoid confusing UI issues and to prevent leaking information about the authentication stack in very specific scenario when "cue" is configured. The "nodetect" option was added to avoid buggy sleep behavior in older versions of libu2f-host and for hypothetical tokens that do not tolerate the double authentication. Detection is performed, and likewise "nodetect" honored, regardless of whether "cue" is also specified.

SELinux

Due to an issue with Fedora Linux, and possibly with other distributions that use SELinux, a system configured with pam-u2f may end up in a situation where access to the credentials file is denied. If the nouserok option is also set, this will result in a successful authentication within the module, without using the FIDO authenticator.

In order to correctly update the security context the command fixfiles onboot should be used on existing installations

Moreover, to allow read access to an authfile or directory placed in a non-standard location, the command

```
# chcon -R -t auth_home_t /path/to/authfile
```

should be used.

For more information see https://access.redhat.com/security/cve/CVE-2020-24612.

## BUGS
Report pam-u2f bugs in the issue tracker: https://github.com/Yubico/pam-u2f/issues

## SEE ALSO
pam(7)

The pam-u2f home page: https://developers.yubico.com/pam-u2f/

YubiKeys can be obtained from Yubico: http://www.yubico.com/


title: pam_chatty(8)

text:
# pam_chatty(8)

## NAME
pam_chatty - A PAM test module that generates PAM info and error messages.

## SYNOPSIS
pam_chatty.so [...]

## DESCRIPTION
The pam_chatty module makes it easy to replicate the behaviour of PAM modules that generate a lot of output, in order to ensure that PAM clients react as expected.

## IMPORTANT
pam_chatty is a test tool. It should be considered completely insecure and never used outside test environments! As you’ll see when reading description of the options, many of them don’t make any sense in the real world and were added just to make tests possible.

The pam_chatty module generates a lot of PAM info and error output, when its authentication method is called, and then returns success.

## OPTIONS
•num_lines=NUMBER - the number of lines of messages to output, for each one of the enabled types of messages selected.

•error - whether to output error level messages.

•info - whether to output info level messages.

## MODULE TYPES PROVIDED
Only the auth module type is supported.

## EXAMPLE

```
auth            required        pam_chatty.so num_lines=16 info error
```


title: pam_get_items(8)

summary: A PAM test module to retrieve module\-specific PAM items

text:
# pam_get_items(8)

## NAME
pam_get_items - A PAM test module to retrieve module-specific PAM items

## SYNOPSIS
pam_get_items.so

## DESCRIPTION
PAM modules store data in PAM items. These items are only accessible from module context, not application context as they might include private data (PAM_AUTHTOK normally contains the password). But when testing PAM modules, it’s often nice to make sure a PAM module under test sets items for the next module the way it’s supposed to. The pam_get_items module makes this possible by exporting all PAM items as environment variables using pam_putenv. The environment variable name is the same as the constant name of the PAM item.

## OPTIONS
None

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## EXAMPLE
Consider an example that tests that pam_unix puts the password it reads onto PAM stack. The test service file would contain:

```
auth required        pam_unix.so
auth required        pam_get_items.so
```

Then the test would run the PAM conversation and afterwards call:

```
pam_getenv(pamh, "PAM_AUTHTOK");
```

To retrieve the password.


title: pam_matrix(8)

text:
# pam_matrix(8)

## NAME
pam_matrix - A PAM test module to retrieve module-specific PAM items

## SYNOPSIS
pam_matrix.so [...]

## DESCRIPTION
Testing PAM application often requires to set up an authentication backend with as little effort as possible. The pam_matrix module allows one to authenticate against a key-value text file, provided by an option or with an environment variable.

## IMPORTANT
pam_matrix is a test tool. It should be considered completely insecure and never used outside test environments! As you’ll see when reading description of the options and actions, many of them don’t make any sense in the real world and were added just to make tests possible.

## PASSWORD DATABASE
The pam_matrix module authenticates user against a plain-text CSV file. The format of the file is as follows:

```
username:password:allowed_service
```

Example: User bob allowed to authenticate with the service sshd

```
bob:secret:sshd
```

## OPTIONS
•passdb=/path/to/file - the patch to the password database. If the database is not provided with this module option, pam_matrix.so reads the PAM_MATRIX_PASSWD environment variable and tries to load the file from there. If that fails as well, PAM_AUTHINFO_UNAVAIL is returned.

•echo - if this option is provided, pam_matrix.so will ask for password using PAM_PROMPT_ECHO_ON, that is, the password will be echoed back to user. This option was added to make it possible to test conversation functions better.

•verbose - if this option is provided, pam_matrix.so will display a PAM_TEXT_INFO message when authentication succeeds and a PAM_ERROR_MSG when authentication fails. This option was added to make it possible to test conversation functions better.

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are supported.

The auth module searches for the user in the passdb file and compares the provided password with the one in the passdb file.

The password module is able to update the password in the passdb file.

The access module compares the service name the PAM conversation was invoked with the allowed service for the user as set in the passdb file.

The session module sets the HOMEDIR PAM environment variable to "/home/%u" where %u stands for the user who opens the session. The variable is unset on session close.

## EXAMPLE

```
auth        required    pam_matrix.so passdb=/tmp/passdb verbose
account     required    pam_matrix.so passdb=/tmp/passdb verbose
password    required    pam_matrix.so passdb=/tmp/passdb verbose
session     required    pam_matrix.so passdb=/tmp/passdb verbose
```


title: pam_set_items(8)

summary: A PAM test module to set module\-specific PAM items

text:
# pam_set_items(8)

## NAME
pam_set_items - A PAM test module to set module-specific PAM items

## SYNOPSIS
pam_set_items.so

## DESCRIPTION
PAM modules store data in PAM items. These items are only accessible from module context, not application context as they might include private data (PAM_AUTHTOK normally contains the password). But when testing PAM modules, it’s often nice to make sure a PAM module under test can retrieve data from the stack. The pam_set_items module makes this possible by reading environment variables and setting them as PAM items.

## OPTIONS
None

## MODULE TYPES PROVIDED
All module types (account, auth, password and session) are provided.

## EXAMPLE
Consider an example that tests that pam_unix is able to read a provided password and doesn’t query on its own. The test service file would contain:

```
auth required        pam_set_items.so
auth required        pam_unix.so
```

Then the test would put the item to the test environment with:

```
setenv("PAM_AUTHTOK", "secret");
```

Then run the PAM conversation.


title: pam_yubico(8)

summary: Module for YubiKey authentication

text:
# pam_yubico(8)

## NAME
pam_yubico - Module for YubiKey authentication

## SYNOPSIS
pam_yubico [...]

## DESCRIPTION
The module is for authentication of YubiKeys, either with online validation of OTP, or offline validation with HMAC-SHA1 challenge-response.

## OPTIONS
debug

Turns on debugging.

debug_file=file

File name to write debug to, the file must exist and be a regular file. Defaults to stdout.

mode=[client|challenge-response]

Mode of operation, client for OTP validation and challenge-response for challenge-response validation. Defaults to client.

authfile=file

Location of the file that holds the mappings of YubiKey token IDs to user names. The format is username:first_public_id:second_public_id:... Default location of the file is $HOME/.yubico/authorized_yubikeys.

id=id

Your API client identity for the validation server.

key=key

Your client key in base64 format. The client key is also known as API key, and provides integrity in the communication between the client (you) and the validation server. If you want to get one for use with the default YubiCloud service, please go to: https://upgrade.yubico.com/getapikey/

alwaysok

Succeed with all authentication attempts (dangerous, presentation mode).

try_first_pass

Before prompting the user for their password, the module first tries the previous stacked module´s password in case that satisfies this module as well.

use_first_pass

Forces the module to use a previous stacked modules password and will never prompt the user - if no password is available or the password is not appropriate, the user will be denied access.

always_prompt

If set, don’t attempt to do a lookup to determine if the user has a YubiKey configured but instead prompt for one no matter what. This is useful in the case where ldap_bind_as_user is enabled but this module is being used to read the user’s password (in a YubiKey+OTP auth scenario).

nullok

Don’t fail when there are no tokens declared for the user in the authorization mapping files or in LDAP. This can be used to make YubiKey authentication optional unless the user has associated tokens.

ldap_starttls

If set, issue a STARTTLS command to the LDAP connection before attempting to bind to it. This is a common setup for servers that only listen on port 389 but still require TLS.

ldap_bind_as_user

Use the user logging in to bind to ldap. This will use the password provided by the user via PAM. If this is set, ldapdn and uid_attr must also be set. Enabling this will cause ldap_bind_user and ldap_bind_password to be ignored.

urllist=list

List of URL templates to be used. This is set by calling ykclient_set_url_bases. The list should be in the format: https://api1.example.com/wsapi/2.0/verify;https://api2.example.com/wsapi/2.0/verify

url=url

This option should not be used, please use the urllist option instead. Set the URL template to use, this is set by calling ykclient_set_url_template. The URL should be set in the format https://api.example.com/wsapi/2.0/verify?id=%d&otp=%s

capath=path

The path where X509 certificates are stored. This is required if https or ldaps are used in url and ldap_uri, respectively.

cainfo=file

Option to allow for usage of a CA bundle instead of path.

proxy=proxy

The proxy to connect to the validation server. Valid schemes are http://, https://, socks4://, socks4a://, socks5:// or socks5h://. Socks5h asks the proxy to do the DNS resolving. If no scheme or port is specified HTTP proxy port 1080 will be used. Example: socks5h://user:pass@10.10.0.1:1080

verbose_otp

Show the One-Time Password when it is entered, i.e. to enable terminal echo of entered characters. You are advised to not use this, if you are using two factor authentication because that will display your password on the screen. This requires the service using the PAM module to display custom fields. This option can not be used with OpenSSH.

ldap_uri=uri

The LDAP server URI (e.g. ldap://localhost).

ldap_server=server

The LDAP server host (default LDAP port is used). Deprecated. Use ldap_uri instead.

ldapdn=dn

The distinguished name (DN) where the users are stored (eg: ou=users,dc=domain,dc=com). If ldap_filter is used this is the base from which the subtree search will be performed.

ldap_clientcertfile=clientcertfile

The path to a client cert file to use when talking to the LDAP server. Note this requires ldap_clientkeyfile to be set as well.

ldap_clientkeyfile=clientkeyfile

The path to a key to be used with the client cert when talking to the LDAP server. Note this requires ldap_clientcertfile to be set as well.

user_attr=attr

The LDAP attribute used to store user names (eg:cn).

yubi_attr=attr

The LDAP attribute used to store the YubiKey ID.

yubi_attr_prefix=prefix

The prefix of the LDAP attribute’s value, in case of a generic attribute, used to store several types of IDs.

token_id_length=length

Length of ID prefixing the OTP (this is 12 if using the YubiCloud).

ldap_bind_user=user

The user to attempt a LDAP bind as.

ldap_bind_password=password

The password to use on LDAP bind.

ldap_filter=filter

A LDAP filter to use for attempting to find the correct object in LDAP. In this string %u will be replaced with the username.

ldap_cacertfile=cacertfile

CA certitificate file for the LDAP connection.

chalresp_path=path

Path of a system-wide directory where challenge-response files can be found for users. Default location is $HOME/.yubico/.

mysql_server=mysqlserver

Hostname/Adress of mysql server. Example 10.0.0.1

mysql_port=mysqlport

Network port of mysql server.

mysql_user=mysqluser

User for accessing to the database. Strongly recommended to use a specific user with read only access.

mysql_password=mysqlpassword

Mysql password associated to the user.

mysql_database=mysqldatabase

the name of the database. Example : otp

## EXAMPLES

```
auth sufficient pam_yubico.so id=16 debug
```

```
auth required pam_yubico.so mode=challenge-response
```

```
auth required pam_yubico.so id=16 ldap_uri=ldaps://ldap.example.com ldap_filter=(uid=%u) yubi_attr=yubiKeyId
```

## FILES
$HOME/.yubico/authorized_yubikeys

If authfile is not set, this file is used for the mapping between YubiKey public ID and in client mode.

$HOME/.yubico/challenge, $HOME/.yubico/challenge-serial_number

If chalresp_path is not set, these files are used to hold next challenge and expected response for the user in challenge-response mode. If chalresp_path is set the filename will be username instead of challenge.

## BUGS
Report yubico-pam bugs in the issue tracker: https://github.com/Yubico/yubico-pam/issues

## SEE ALSO
ykpamcfg(1), pam(7)

The yubico-pam home page: https://developers.yubico.com/yubico-pam/

YubiKeys can be obtained from Yubico: http://www.yubico.com/


paris-traceroute

package: paris-traceroute

title: paris-traceroute(8)

text:
# paris-traceroute(8)

## NAME
paris-traceroute - print the IP-level routes between two Internet hosts.

## SYNOPSIS
paris-traceroute [ -fhilnqvV ] [ -b initial_id ]

[ -d dest_port ] [ -a algorithm ] [ -f first_ttl ]

[ -L packetlen ] [ -m max_ttl ]

[ -M max_missing_hops ] [ -p protocol ]

[ -q nqueries ] [ -s source_port ] [ -t tos ]

[ -T delaymsecs ] [ -w waittime ]

host

## DESCRIPTION
Paris traceroute is a new version of the well-known network diagnosis tool. It addresses problems caused by load balancers with the initial traceroute(8) implementation. By controlling the flow identifier of the probes, it is able to follow accurate paths in networks with load balancers. It is also able to find all the load balanced paths to the destination. Finally, it enriches its output with information extracted from the received packets, allowing a more precise analysis of the discovered paths.

Options are:

-a

Set the probing algorithm:

hopbyhop

Send q (configured with the -q flag) probes with the same TTL, then wait for all the replies or a timeout. Increment the TTL and reiter the operation until we reach the destination. All packets hold the same flow identifier.

packetbypacket

It is the classic traceroute(8) algorithm: send one probe at a time, then wait for a reply or a timeout. Reiter the operation until we reach the destination.

concurrent

Send all the probes from min_ttl to max_ttl and wait for all replies or a timeout.

scout

Send a scout probe with a ttl max to the destination. If the destination can be reached, compute the number of hops used to reach the destination and start the concurrent algorithm with a max_ttl equal to this number of hops. If the destination cannot be reached, the hopbyhop algorithm will be used instead. This algorithm is only usable with UDP probes.

exhaustive

Print all the possible "load balanced" paths to the destination. (See section EXHAUSTIVE ALGORITHM )

-b

Set the initial probe identifier.

-d

Set the the UDP/TCP destination port (default: 33457).

-f

Set the initial ttl (default: 1).

-h

Print help.

-i

Print the "IP Identifier" value of the responses. It is used to identify the different interfaces of a router, or uncover NAT boxes.

-l

Display the ttl value of the reply. Useful to study asymmetric routing and NAT boxes.

-L

Set the data length to be used in outgoing packets. (default: 0).

-m

Set the maximum ttl (default: 30).

-M

Set the maximum number of consecutive unresponsive hops which causes the program to abort (default 3).

-n

Print hop addresses numerically. The default is to print also hostnames.

-p

Set the protocol to use (possible values: udp, tcp, icmp).

-q

Set the number of probes per hop (default: 3).

-s

Set the UDP/TCP source port (default: 33456).

-t

Set the Type of Service (default: 0). This field is taken into account by many per-flow load balancers: in presence of such a load balancer, packets having different TOS values are likely to follow a different paths.

-T

Set the time to wait between probes, in milliseconds (default 50ms).

-v

Print debug messages.

-V

Print the program version.

-w

Set the time to wait for a response, in milliseconds (default 5000ms).

## EXHAUSTIVE ALGORITHM
With the deployment of load balancing, there is no longer only one path between two Internet hosts. This algorithm sends enough probes at each hop to find all the possible interfaces. Unlike the other algorithms, it varies the flow identifier of the probes in a controlled manner, to ensure the discovery of all the interfaces with a high confidence degree. It also categorizes load balancers as "per-packet" (pseudo-random, round-robin packet balancing) or "per-flow" (packets belonging to the same flow follow the same path).

In case of per-flow load balancing, it prints additional information to track flows. The following trace shows the enriched output:

```
14  1.1.1.1:0,1,3  539.065 ms  1.1.1.2:2,4,5  492.152 ms
15  2.2.2.2:0,1,3  563.163 ms  2.2.2.3:2,4,5  470.919 ms
```

Integers listed after the interface addresses are "flow identifiers": they are used to identify a flow in the set of interfaces found by the algorithm. For example, flow #0 traverses interfaces 1.1.1.1 and 2.2.2.2. This is the same for flows 1 and 3 while flows 2, 4 and 5 traverse 1.1.1.2 and 2.2.2.3.

## OUTPUT
The following information are extracted from the response packets and displayed:

Response TTL

The TTL of the responses (from the routers and the destination) is optionally displayed in square brackets (Use the -l flag ).

Original TTL

This is the TTL of the probe when it was received and dropped by the router. If the original TTL is different than 1, it is displayed with a !Tx symbol, where x is the value of the TTL. For example, !T0 indicates that the value of the TTL was 0 when the probe reached the router that discarded it.

IP Identifier

This the identifier of the IP error packet sent by the router. This field is set with the value of an internal 16-bit counter usually incremented for each packet sent. This value is optionally displayed inside brackets. For instance {1234} indicates that the probe had its identifier set to 1234.

MPLS labels

If the packet contains ICMP extensions for MPLS, the MPLS label stack is diplayed in an additionnal line just after the current hop line. Labels of the same stack are separated with a "|" character.

Other ICMP error messages

Paris traceroutes uses the same convensions as traceroute(8) to display unexpected ICMP messages (i.e. different than TIME_EXCEEDED, PORT_UNREACHABLE and ECHO_REPLY).

## SEE ALSO
traceroute(8), pathchar(8), netstat(1), ping(8)

## AUTHOR
The initial version of traceroute(8) was implemented by Van Jacobson from a suggestion by Steve Deering. Paris traceroute was implemented by Xavier Cuvellier. Debugged and enhanced by Brice Augustin.

The current version is available at:

http://www.paris-traceroute.net

## BUGS
Please send bug reports to brice.augustin@rp.lip6.fr.


partclone

package: partclone

title: partclone(8)

text:
# partclone(8)

## NAME
partclone - The utility for clone and restore a partition.

## SYNOPSIS
partclone.[fstype] {[-c | --clone]} {[-r | --restore]} {[-b | --dev-to-dev]} {[-s | --source] source} {[[-o | --output] [-O | --overwrite]] target} [[-dX | --debug=X]] [[--restore_raw_file]] [[-z | --buffer_size]] [[-N | --ncurses]] [[-q | --quiet]] [[-f | --UI-fresh]] [[-F | --force]] [[-I | --ignore_fschk]] [[-i | --ignore_crc]] [[-C | --nocheck]] [[-R | --rescue]] [[-L | --logfile] logfile] [[-X | --compresscmd]] [[-D | --domain]] [[--offset_domain]] [[-aX | --checksum-mode=X]] [[-kX | --blocks-per-checksum=X]] [[-K | --no-reseed]] [[-w | --skip_write_error]] [[-E | --offset=X]] [[-T | --btfiles]] [[-t | --btfiles_torrent]] [[-n | --note]] [[-B | --no_block_detail]] [[--binary-prefix]] [[--prog-second]] [[--write-direct-io]] [[--read-direct-io]]

## DESCRIPTION
partclone.[fstype] is a part of Partclone project. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone supported file system include btrfs, ext2, ext3, ext4, reiserfs, reiser4, xfs and jfs for LINUX. Also support some non-linux operation system, ex: NTFS, FAT and EXFAT (for Windows), HFS plus (APPLE MAC OS), UFS2 (FreeBSD), VMFS (VMWare Vsphere) and MINIX (MINIX3).

All partclone utils could be run like partclone.[fstype] is very similar to fsck or mkfs. For example, for backup/restore hfsplus, just run partclone.hfsp

```
       File System                 partclone.[fstype]

       btrfs                       partclone.btrfs

       ext2, ext3, ext4            partclone.[ext2 | ext3 | ext4]

       reiserfs 3.5                partclone.reiserfs

       reiser 4                    partclone.reiser4

       xfs                         partclone.xfs

       ufs | ufs2                  partclone.ufs

       jfs                         partclone.jfs

       hfs plusfs                  partclone.[hfs+ | hfsplus]

       vmfs                        partclone.[vmfs | vmfs5]

       ntfs                        partclone.ntfs

       fat12, fat16, fat32         partclone.[fat12 | fat16 | fat32]

       exfat                       partclone.exfat

       minix                       partclone.minix

       f2fs                        partclone.f2fs

       nilfs2                      partclone.nilfs2

       apfs                        partclone.apfs

       others (Not Supported FS)   partclone.imager

```

## OPTIONS
The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

-s FILE, --source FILE

Source FILE. The FILE could be a image file (made by partclone) or device depend on your action. Normally, backup source is device, restore source is image file. Receving data from pipe line is supported ONLY for restoring, just ignore -s option or use '-' means receive data from stdin.

-o FILE, --output FILE

Output FILE. The FILE could be a image file (partclone will generate) or device depend on your action. Normally, backup output to image file and restore output to device. Sending data to pipe line is also supported ONLY for back-up, just ignore -o option or use '-' means send data to stdout.

-O FILE, --overwrite FILE

Overwrite FILE, overwriting if exists.

-W FILE, --restore_raw_file FILE

create special raw file for loop device.

-c, --clone

Save partition to the special image format.

-r, --restore

Restore partition from the special image format.

-b, --dev-to-dev

Local device to device copy on-the-fly, source and output both are device.

-D, --domain

Create GNU Ddrescue domain log file from source device. This is a human readable file in which + marks used block areas and ? marks free areas.

--offset_domain=X

Add X (in bytes) to all positions reported in the domain log file

--restore_raw_file

Creating special raw file for loop device.

-L FILE, --logfile FILE

put special path to record partclone log information. (default /var/log/partclone.log)

-R, --rescue

Continue after disk read errors.

-C, --no_check

Don't check device size and free space.

-N, --ncurses

Using Ncurses Text User Interface.

-I, --ignore_fschk

Ignore filesystem check.

-i, --ignore_crc

Ignore crc check error.

-F, --force

Force progress.

-f sec, --UI-fresh sec

put special second to different interval.

-z size, --buffer_size size

Read/write buffer size (default: 1048576)

-q, --quiet

Disable progress message.

-dlevel, --debug level

Set the debug level [1|2|3]

-x, --compresscmd CMD

Start CMD as an output pipe to compress the cloned image

-aX, --checksum-mode=X

Checksum formula to use to add error detection where X:

0: No checksum (no slowdown, smallest image)

1: CRC32 (Fast to compute, basic detection)

2: xxHash64 extremely fast non-cryptographic hash algorithm

3: xxHash128 Strong and extremely fast, best detection

-kX, --blocks-per-checksum=X

Write one checksum for every X blocks

-w, --skip_write_error

Continue restore while write errors

--write-direct-io

Writing data to TARGET partition without cache

--read-direct-io

Reading data from SOURCE partition without cache

-B, --no_block_detail

Show progress message without block detail

--binary-prefix

Show progress with bit size (default is MB, GB...)

--prog-second

Show progress in seconds (default is minute)

-E, --offset=X

Add offset X (bytes) to OUTPUT

-T, --btfiles

Restore block as file for ClonezillaBT.

-t, --btfiles_torrent

Restore block as file for ClonezillaBT but only generate torrent.

-n, --note NOTE

Display Message Note (128 words).

-h, --help

Show summary of options.

-v, --version

Show version of program.

## FILES
/var/log/partclone.log

The log file of partclone

## EXAMPLES

```
 clone /dev/hda1 to hda1.img and display debug information.

   partclone.ext3 -c -d -s /dev/hda1 -o hda1.img

 restore /dev/hda1 from hda1.img and display debug information.

   partclone.extfs -r -d -s hda1.img -o /dev/hda1

 restore image from clonezilla (split, gzip,) with stdin source

   cat sda1.ext3-ptcl-img.gz.a* | gunzip -c | partclone.ext3 -d -r -s - -o /dev/sda1

```

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone provides some return codes, that can be used in scripts:

Code

Diagnostic

0

Program exited successfully.

1

Clone or Restore seem failed.

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

You can get support at http://partclone.org

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


partclone.chkimg

title: partclone.chkimg(8)

text:
# partclone.chkimg(8)

## NAME
partclone.chkimg - The utility to check image made by partclone

## SYNOPSIS
partclone.chkimg {[-s | --source] source} [[-dX | --debug=X] [-N | --ncurses] [-f | --UI-fresh] [-F | --force] [--ignore_crc]] [[-C | --no_check] [-B | --no_block_detail] [-z | --buffer_size] [-L | --logfile] logfile]

## DESCRIPTION
partclone.chkimg is a part of Partclone project to verify image files. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone supported file system include btrfs, ext2, ext3, ext4, reiserfs, reiser4, xfs and jfs for LINUX. Also support some non-linux operation system, ex: NTFS, FAT, EXFAT (for Windows), HFS plus (APPLE MAC OS), UFS2 (FreeBSD), VMFS (VMWare Vsphere). All partclone utils could be run like partclone.xxx is very smiliar fsck or mkfs. For example, for backup/restore hfsplus, just run partclone.hfsp.

## OPTIONS
The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

-s FILE, --source FILE

Source FILE. The FILE could be a image file (made by partclone) or device depend on your action. Normally, backup source is device, restore source is image file. Receving data from pipe line is supported ONLY for restoring, just ignore -s option or use '-' means receive data from stdin.

-L FILE, --logfile FILE

put special path to record partclone log information. (default /var/log/partclone.log)

-C, --no_check

Don't check device size and free space.

-N, --ncurses

Using Ncurses Text User Interface.

-X, --dialog

Output message as Dialog Format.

--ignore_crc

Ignore crc check error.

-F, --force

Force progress.

-f sec, --UI-fresh sec

put special second to different interval.

-dlevel, --debug level

Set the debug level [1|2|3]

-h, --help

Show summary of options.

-v, --version

Show version of program.

## FILES
/var/log/partclone.log

The log file of partclone.chkimg

## EXAMPLES

```
 check part.img file is correct or not.

   partclone.chkimg -d -s partclone.img

```

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone.chkimg provides some return codes, that can be used in scripts:

Code

Diagnostic

0

Program exited successfully.

1

Clone or Restore seem failed.

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

You can get support at http://partclone.org

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


partclone.dd

title: partclone.dd(8)

text:
# partclone.dd(8)

## NAME
partclone.dd - unsupported file system backup utility.(like `dd` )

## SYNOPSIS
partclone.dd {[-s | --source] source} {[[-o | --output] [-O | --overwrite]] target} [[-dX | --debug=X]] [[--restore_raw_file]] [[-z | --buffer_size]] [[-N | --ncurses]] [[-q | --quiet]] [[-f | --UI-fresh]] [[-F | --force]] [[-I | --ignore_fschk]] [[-i | --ignore_crc]] [[-C | --nocheck]] [[-R | --rescue]] [[-L | --logfile] logfile] [[-D | --domain]] [[--offset_domain]] [[-aX | --checksum-mode=X]] [[-kX | --blocks-per-checksum=X]] [[-K | --no-reseed]] [[-w | --skip_write_error]] [[-E | --offset=X]] [[-T | --btfiles]] [[-t | --btfiles_torrent]] [[-B | --no_block_detail]] [[--binary-prefix]] [[--prog-second]] [[--write-direct-io]] [[--read-direct-io]] [[-S | --device-size]]

## DESCRIPTION
partclone.dd is a part of Partclone project to clone unsupported file system with dd method. It will backup all block from partition. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone supported file system include btrfs, ext2, ext3, ext4, reiserfs, reiser4, xfs and jfs for LINUX. Also support some non-linux operation system, ex: NTFS and FAT (for Windows), HFS plus(APPLE MAC OS), UFS2(FreeBSD), VMFS(VMWare Vsphere).

All partclone utils could be run like partclone.xxx is very similar fsck or mkfs. For example, for backup/restore hfsplus, just run partclone.hfsp.

## OPTIONS
The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

-s FILE, --source FILE

Source FILE. The FILE could be a image file (made by partclone) or device depend on your action. Normally, backup source is device, restore source is image file. Receving data from pipe line is supported ONLY for restoring, just ignore -s option or use '-' means receive data from stdin.

-o FILE, --output FILE

Output FILE. The FILE could be a image file (partclone will generate) or device depend on your action. Normally, backup output to image file and restore output to device. Sending data to pipe line is also supported ONLY for back-up, just ignore -o option or use '-' means send data to stdout.

-O FILE, --overwrite FILE

Overwrite FILE, overwriting if exists.

-W FILE, --restore_raw_file FILE

create special raw file for loop device.

-D, --domain

Create GNU Ddrescue domain log file from source device. This is a human readable file in which + marks used block areas and ? marks free areas.

--offset_domain=X

Add X (in bytes) to all positions reported in the domain log file

--restore_raw_file

Creating special raw file for loop device.

-L FILE, --logfile FILE

put special path to record partclone log information. (default /var/log/partclone.log)

-R, --rescue

Continue after disk read errors.

-C, --no_check

Don't check device size and free space.

-N, --ncurses

Using Ncurses Text User Interface.

-I, --ignore_fschk

Ignore filesystem check.

-i, --ignore_crc

Ignore crc check error.

-F, --force

Force progress.

-f sec, --UI-fresh sec

put special second to different interval.

-z size, --buffer_size size

Read/write buffer size (default: 1048576)

-q, --quiet

Disable progress message.

-dlevel, --debug level

Set the debug level [1|2|3]

-aX, --checksum-mode=X

Checksum formula to use to add error detection where X:

0: No checksum (no slowdown, smallest image)

1: CRC32 (Fast to compute, basic detection)

-kX, --blocks-per-checksum=X

Write one checksum for every X blocks

-w, --skip_write_error

Continue restore while write errors

--write-direct-io

Writing data to TARGET partition without cache

--read-direct-io

Reading data from SOURCE partition without cache

-S, --device-size

Define device size

-B, --no_block_detail

Show progress message without block detail

--binary-prefix

Show progress with bit size (default is MB, GB...)

--prog-second

Show progress in seconds (default is minute)

-E, --offset=X

Add offset X (bytes) to OUTPUT

-T, --btfiles

Restore block as file for ClonezillaBT.

-t, --btfiles_torrent

Restore block as file for ClonezillaBT but only generate torrent.

-h, --help

Show summary of options.

-v, --version

Show version of program.

## FILES
/var/log/partclone.log

The log file of partclone.dd

## EXAMPLES

```
 clone /dev/hda1 to hda1.dd.img and display debug information.

   partclone.dd -d -s /dev/hda1 -o hda1.dd.img

 restore /dev/hda1 from hda1.dd.img and display debug information.

   partclone.dd -d -s hda1.dd.img -o /dev/hda1

```

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone.dd provides some return codes, that can be used in scripts:

Code

Diagnostic

0

Program exited successfully.

1

Clone or Restore seem failed.

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

You can get support at http://partclone.org

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


partclone.info

title: partclone.info(8)

text:
# partclone.info(8)

## NAME
partclone.info - The utility to show image head information.

## SYNOPSIS
partclone.info {FILE}

## DESCRIPTION
partclone.info is a part of Partclone project to retrieve partition head information from image files. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone supported file system include btrfs, ext2, ext3, ext4, reiserfs, reiser4, xfs and jfs for LINUX. Also support some non-linux operation system, ex: NTFS, FAT, EXFAT (for Windows), HFS plus (APPLE MAC OS), UFS2 (FreeBSD), VMFS (VMWare Vsphere). All partclone utils could be run like partclone.xxx is very smiliar fsck or mkfs. For example, for backup/restore hfsplus, just run partclone.hfsp.

## OPTIONS
The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

FILE

Image FILE. The FILE could be a image file (made by partclone).

## EXAMPLES

```
  Retriving partition usage information

    partclone.info /home/partimag/sdb2.img

    Partclone v0.2.20 http://partclone.org

    File system:  EXTFS

    Device size:  928.0 MB

    Space in use: 535.4 MB

    Free Space:   392.6 MB

    Block size:   4096 Byte

    Used block :  130708

```

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone.info provides some return codes, that can be used in scripts:

Code

Diagnostic

0

Program exited successfully.

1

Clone or Restore seem failed.

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

You can get support at http://partclone.org

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


partclone.ntfsfixboot

title: partclone.ntfsfixboot(8)

text:
# partclone.ntfsfixboot(8)

## NAME
partclone.ntfsfixboot - deals with braindeadness with moving NTFS filesystems.

## SYNOPSIS
partclone.ntfsfixboot [-w] [-h n] [-t n] [-s n] [-b] [-f] [-p] {DEVICE}

## DESCRIPTION
partclone.ntfsfixboot is NOT a part of Partclone project but included to fix ntfs boot issue. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone.ntfsfixboot deals with braindeadness with moving NTFS filesystems. writted by Orgad Shaneh (2009) and Daniel J. Grace (2006).

## OPTIONS
The program follows the usual GNU command line syntax,a summary of options is included below.

-w

Write new start sector to the partition.

-h num

Specify number of heads per track. If omitted, determined via ioctl.

-t num

Specify number of sectors per track. If omitted, determined via ioctl.

-s num

New start sector to write. If omitted, determined via ioctl.

-b

Proceed even if the specified device is not a partition.

-f

Force the operation to occur even if device does not look like a valid NTFS partition or values are equal.

-p

Print debug information (values read, values requested etc.

device

where device points to an NTFS partition

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone.ntfsfixboot provides some return codes, that can be used in scripts:

Code

Diagnostic

0

success (values are correct, or changed successfully)

1

a change is needed, but -w was not specified

2

an error occured

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

Report bugs to upstrem http://sourceforge.net/projects/ntfsfixboot/.

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


partclone.restore

title: partclone.restore(8)

summary: restore partclone image to device.

text:
# partclone.restore(8)

## NAME
partclone.restore - restore partclone image to device.

## SYNOPSIS
partclone.restore {[-s | --source] source} {[[-o | --output] [-O | --overwrite]] target} [[-dX | --debug=X]] [[--restore_raw_file]] [[-z | --buffer_size]] [[-N | --ncurses]] [[-q | --quiet]] [[-f | --UI-fresh]] [[-F | --force]] [[-I | --ignore_fschk]] [[--ignore_crc]] [[-C | --nocheck]] [[-R | --rescue]] [[-L | --logfile] logfile] [[-w | --skip_write_error]] [[--write-direct-io]] [[-w | --skip_write_error]] [[-E | --offset=X]] [[-T | --btfiles]] [[-t | --btfiles_torrent]] [[-B | --no_block_detail]]

## DESCRIPTION
partclone.restore is a part of Partclone project to restore all image made from partclone.[fstype] or partclone.dd. Partclone provide utilities to backup used blocks and design for higher compatibility of the file system by using existing library, e.g. e2fslibs is used to read the used block of ext2 partition.

Partclone supported file system include btrfs, ext2, ext3, ext4, reiserfs, reiser4, xfs and jfs for LINUX. Also support some non-linux operation system, ex: NTFS, FAT, EXFAT (for Windows), HFS plus (APPLE MAC OS), UFS2 (FreeBSD), VMFS (VMWare Vsphere).

All partclone utils could be run like partclone.xxx is very similar to fsck or mkfs. For example, for backup/restore hfsplus, just run partclone.hfsp.

## OPTIONS
The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

-s FILE, --source FILE

Source FILE. The FILE could be a image file (made by partclone) or device depend on your action. Normally, backup source is device, restore source is image file. Receving data from pipe line is supported ONLY for restoring, just ignore -s option or use '-' means receive data from stdin.

-o FILE, --output FILE

Output FILE. The FILE could be a image file (partclone will generate) or device depend on your action. Normally, backup output to image file and restore output to device. Sending data to pipe line is also supported ONLY for back-up, just ignore -o option or use '-' means send data to stdout.

-O FILE, --overwrite FILE

Overwrite FILE, overwriting if exists.

--restore_raw_file

Creating special raw file for loop device.

-L FILE, --logfile FILE

put special path to record partclone log information. (default /var/log/partclone.log)

-R, --rescue

Continue after disk read errors.

-C, --no_check

Don't check device size and free space.

-N, --ncurses

Using Ncurses Text User Interface.

-X, --dialog

Output message as Dialog Format.

-I, --ignore_fschk

Ignore filesystem check.

--ignore_crc

Ignore crc check error.

-F, --force

Force progress.

-f sec, --UI-fresh sec

put special second to different interval.

-z size, --buffer_size size

Read/write buffer size (default: 1048576)

-q, --quiet

Disable progress message.

-dlevel, --debug level

Set the debug level [1|2|3]

-h, --help

Show summary of options.

-v, --version

Show version of program.

## FILES
/var/log/partclone.log

The log file of partclone.restore

## EXAMPLES

```
 restore /dev/hda1 from hda1.img and display debug information.

  partclone.restore -d -s hda1.img -o /dev/hda1

 restore image from clonezilla (split, gzip,) with stdin source

  cat  sda1.ext3-ptcl-img.gz.a*  | gunzip -c | partclone.restore -d -s - -o /dev/sda1

 restore  raw  image  from  partclone.dd

  partclone.dd  -d  -c  -s  /dev/sda1  -o  - | partclone.restore -d -s - -o /dev/sdb1

```

## DIAGNOSTICS
The following diagnostics may be issued on stderr:

partclone.restore provides some return codes, that can be used in scripts:

Code

Diagnostic

0

Program exited successfully.

1

Clone or Restore seem failed.

## BUGS
Report bugs to thomas@clonezilla.org or http://partclone.org.

You can get support at http://partclone.org

## SEE ALSO
partclone(8), partclone.chkimg(8), partclone.restore(8), partclone.dd(8), partclone.info(8)

## AUTHOR
Yu-Chin Tsai <thomas@clonezilla.org>

## COPYRIGHT
Copyright © 2007 Yu-Chin Tsai

This manual page was written for the Debian system (and may be used by others).

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or (at your option) any later version published by the Free Software Foundation.

On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.


parted

package: parted

title: parted(8)

summary: a partition manipulation program

text:
# parted(8)

## NAME
parted - a partition manipulation program

## SYNOPSIS
parted [options] [device [command [options...]...]]

## DESCRIPTION
parted is a program to manipulate disk partitions. It supports multiple partition table formats, including MS-DOS and GPT. It is useful for creating space for new operating systems, reorganising disk usage, and copying data to new hard disks.

This manual page documents parted briefly. Complete documentation is distributed with the package in GNU Info format.

## OPTIONS
-h, --help

displays a help message

-l, --list

lists partition layout on all block devices

-m, --machine

displays machine parseable output

-j, --json

displays JSON output

-s, --script

never prompts for user intervention. Automatically answers 'NO' if a warning is encountered, eg. when shrinking a partition.

-f, --fix

automatically answer "fix" to exceptions in script mode

-v, --version

displays the version

-a alignment-type, --align alignment-type

Set alignment for newly created partitions, valid alignment types are:

none

Use the minimum alignment allowed by the disk type.

cylinder

Align partitions to cylinders.

minimal

Use minimum alignment as given by the disk topology information. This and the opt value will use layout information provided by the disk to align the logical partition table addresses to actual physical blocks on the disks. The min value is the minimum alignment needed to align the partition properly to physical blocks, which avoids performance degradation.

optimal

Use optimum alignment as given by the disk topology information. This aligns to a multiple of the physical block size in a way that guarantees optimal performance.

## COMMANDS
[device]

The block device to be used. When none is given, parted will use the first block device it finds.

[command [options]]

Specifies the command to be executed. If no command is given, parted will present a command prompt. Possible commands are:

help [command]

Print general help, or help on command if specified.

align-check type partition

Check if partition satisfies the alignment constraint of type. type must be "minimal" or "optimal".

mklabel label-type

Create a new disklabel (partition table) of label-type. label-type should be one of "aix", "amiga", "bsd", "dvh", "gpt", "loop", "mac", "msdos", "pc98", or "sun".

mkpart [part-type name fs-type] start end

Create a new partition. part-type may be specified only with msdos and dvh partition tables, it should be one of "primary", "logical", or "extended". name is required for GPT partition tables and fs-type is optional. fs-type can be one of "btrfs", "ext2", "ext3", "ext4", "fat16", "fat32", "hfs", "hfs+", "linux-swap", "ntfs", "reiserfs", "udf", or "xfs".

name partition name

Set the name of partition to name. This option works only on Mac, PC98, and GPT disklabels. The name can be placed in double quotes, if necessary. And depending on the shell may need to also be wrapped in single quotes so that the shell doesn't strip off the double quotes.

print print-type

Display the partition table. print-type is optional, and can be one of devices, free, list, or all.

quit

Exit from parted.

rescue start end

Rescue a lost partition that was located somewhere between start and end. If a partition is found, parted will ask if you want to create an entry for it in the partition table.

resizepart partition end

Change the end position of partition. Note that this does not modify any filesystem present in the partition.

rm partition

Delete partition.

select device

Choose device as the current device to edit. device should usually be a Linux hard disk device, but it can be a partition, software raid device, or an LVM logical volume if necessary.

set partition flag state

Change the state of the flag on partition to state. Supported flags are: "boot", "root", "swap", "hidden", "raid", "lvm", "lba", "legacy_boot", "irst", "msftres", "esp", "chromeos_kernel", "bls_boot", "linux-home", "no_automount", "bios_grub", and "palo". state should be either "on" or "off".

unit unit

Set unit as the unit to use when displaying locations and sizes, and for interpreting those given by the user when not suffixed with an explicit unit. unit can be one of "s" (sectors), "B" (bytes), "kB", "MB", "KiB", "MiB", "GB", "GiB", "TB", "TiB", "%" (percentage of device size), "cyl" (cylinders), "chs" (cylinders, heads, sectors), or "compact" (megabytes for input, and a human-friendly form for output).

toggle partition flag

Toggle the state of flag on partition.

type partition id or uuid

On MS-DOS set the type aka. partition id of partition to id. The id is a value between "0x01" and "0xff". On GPT the type-uuid of partition to uuid.

disk_set flag state

Change a flag on the disk to state. A flag can be either "on" or "off". Some or all of these flags will be available, depending on what disk abel you are using. Supported flags are: "pmbr_boot" on GPT to enable the boot flag on the GPT's protective MBR partition.

disk_toggle flag

Toggle the state of the disk flag.

version

Display version information and a copyright message.

## UNITS
parted will compute sensible ranges for the locations you specify when using units like "GB", "MB", etc. Use the sector unit "s" or IEC binary units like "GiB", "MiB", to specify exact locations. When you specify start or end values using IEC binary units like "MiB", "GiB", "TiB", etc., parted treats those values as exact, and equivalent to the same number specified in bytes (i.e., with the "B" suffix), in that it provides no helpful range of sloppiness. Contrast that with a partition start request of "4GB", which may actually resolve to some sector up to 500MB before or after that point. Thus, when creating a partition in an exact location you should use units of bytes ("B"), sectors ("s"), or IEC binary units like "MiB", "GiB", but not "MB", "GB", etc.

## REPORTING BUGS
Report bugs to <bug-parted@gnu.org>

## SEE ALSO
fdisk(8), mkfs(8), The parted program is fully documented in the info(1) format GNU partitioning software manual.

## AUTHOR
This manual page was written by Timshel Knoll <timshel@debian.org>, for the Debian GNU/Linux system (but may be used by others).


partprobe

title: partprobe(8)

text:
# partprobe(8)

## NAME
partprobe - inform the OS of partition table changes

## SYNOPSIS
partprobe [-d] [-s] [devices...]

## DESCRIPTION
This manual page documents briefly the partprobe command.

partprobe is a program that informs the operating system kernel of partition table changes.

## OPTIONS
This program uses short UNIX style options.

-d, --dry-run

Don't update the kernel.

-s, --summary

Show a summary of devices and their partitions.

-h, --help

Show summary of options.

-v, --version

Show version of program.

## REPORTING BUGS
Report bugs to <bug-parted@gnu.org>

## SEE ALSO
parted(8).

## AUTHOR
This manual page was written by Timshel Knoll <timshel@debian.org>, for the Debian GNU/Linux system (but may be used by others).


passwd

package: passwd

title: passwd(8)

summary: passwd wrapper

text:
# passwd(8)

## NAME
passwd - passwd wrapper

## SYNOPSIS
passwd [OPTION...] [USERNAME]

## DESCRIPTION
passwd wrapper implements traditional passwd options using real passwd utility or shadow utils.

Valid options are:

-d, --delete

Set an empty password for the specified account

-f, --force

Force operation

-k, --keep-tokens

Keep non-expired authentication tokens

-l, --lock

Lock the specified account

--stdin

Read new tokens from stdin

-S, --status

Report password status on the specified account

-u, --unlock

Unlock the specified account

-?, --help

Give this help list

--usage

Give a short usage message

-V, --version

Print program version

## EXIT CODE
On successful completion of its task, passwd will complete with exit code 0. An exit code of 1 indicates an error occurred. Textual errors are written to the standard error stream.

## AUTHOR
Written by Dmitry V. Levin <ldv@altlinux.org>

## REPORTING BUGS
Report bugs to http://bugs.altlinux.ru/.

## COPYRIGHT
Copyright © 2002, 2003, 2004 Dmitry V. Levin <ldv@altlinux.org>

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO
passwd(1), chpasswd(8), usermod(8).