neulab/tldr huggingface dataset:
By default, only stateless compression algorithms which do not maintain state from one packet to the next (and which can be used on UDP transports) are enabled. By setting the mode to all stateful algorithms (currently only zlib deflate) can be enabled. Or all compression can be disabled by setting the mode to none.
--force-dpd=INTERVAL Use INTERVAL as minimum Dead Peer Detection interval (in seconds) for CSTP and DTLS, forcing use of DPD even when the server doesn't request it.
-g,--usergroup=GROUP Use GROUP as login UserGroup
-F,--form-entry=FORM:OPTION=VALUE Provide authentication form input, where FORM and OPTION are the identifiers from the form and the specific input field, and VALUE is the string to be filled in automatically. For example, the standard username field (also handled by the --user option) could also be provided with this option thus: --form-entry main:username=joebloggs.
-h,--help Display help text
--http-auth=METHODS Use only the specified methods for HTTP authentication to a server.  By default, only Negotiate, NTLM and Digest authentication are enabled. Basic authentication is also supported but because it is insecure it must be explicitly enabled. The argument is a comma-separated list of methods to be enabled. Note that the order does not matter: OpenConnect will use Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled, regardless of the order specified in the METHODS string.
-i,--interface=IFNAME Use IFNAME for tunnel interface
-l,--syslog Use syslog for progress messages
--timestamp Prepend a timestamp to each progress message
--passtos Copy TOS / TCLASS of payload packet into DTLS and ESP packets. This is not set by default because it may leak information about the payload (for example, by differentiating voice/video traffic).
-U,--setuid=USER Drop privileges after connecting, to become user USER
--csd-user=USER Drop privileges during execution of trojan binary or script (CSD, TNCC, or HIP).
--csd-wrapper=SCRIPT Run SCRIPT instead of the trojan binary or script.
--force-trojan=INTERVAL Use INTERVAL as interval (in seconds) for repeat execution of Trojan binary or script, overriding default and/or server-set interval.
-m,--mtu=MTU Request MTU from server as the MTU of the tunnel.
--base-mtu=MTU Indicate MTU as the path MTU between client and server on the unencrypted network. Newer servers will automatically calculate the MTU to be used on the tunnel from this value.
-p,--key-password=PASS Provide passphrase for certificate file, or SRK (System Root Key) PIN for TPM
-P,--proxy=PROXYURL Use HTTP or SOCKS proxy for connection. A username and password can be provided in the given URL, and will be used for authentication. If authentication is required but no credentials are given, GSSAPI and automatic NTLM authentication using Samba's ntlm_auth helper tool may be attempted.
--proxy-auth=METHODS Use only the specified methods for HTTP authentication to a proxy. By default, only Negotiate, NTLM and Digest authentication are enabled. Basic authentication is also supported but because it is insecure it must be explicitly enabled. The argument is a comma- separated list of methods to be enabled. Note that the order does not matter: OpenConnect will use Negotiate, NTLM, Digest and Basic authentication in that order, if each is enabled, regardless of the order specified in the METHODS string.
--no-proxy Disable use of proxy
--libproxy Use libproxy to configure proxy automatically (when built with libproxy support)
--key-password-from-fsid Passphrase for certificate file is automatically generated from the fsid of the file system on which it is stored. The fsid is obtained from the statvfs(2) or statfs(2) system call, depending on the operating system. On a Linux or similar system with GNU coreutils, the fsid used by this option should be equal to the output of the command: stat --file-system --printf=%i\\n $CERTIFICATE It is not the same as the 128-bit UUID of the file system.
-q,--quiet Less output
-Q,--queue-len=LEN Set packet queue limit to LEN pkts
-s,--script=SCRIPT Invoke SCRIPT to configure the network after connection. Without this, routing and name service are unlikely to work correctly. The script is expected to be compatible with the vpnc-script which is shipped with the "vpnc" VPN client. See http://www.infradead.org/openconnect/vpnc-script.html for more information. This version of OpenConnect is configured to use /etc/vpnc/vpnc-script by default.
On Windows, a relative directory for the default script will be handled as starting from the directory that the openconnect executable is running from, rather than the current directory. The script will be invoked with the command-based script host cscript.exe.
-S,--script-tun Pass traffic to 'script' program over a UNIX socket, instead of to a kernel tun/tap device. This allows the VPN IP traffic to be handled entirely in userspace, for example by a program which uses lwIP to provide SOCKS access into the VPN.
-u,--user=NAME Set login username to NAME
-V,--version Report version number
-v,--verbose More output (may be specified multiple times for additional output)
-x,--xmlconfig=CONFIG XML config file
--authgroup=GROUP Choose authentication login selection
--authenticate Authenticate only, and output the information needed to make the connection a form which can be used to set shell environment variables. When invoked with this option, openconnect will not make the connection, but if successful will output something like the following to stdout: COOKIE=3311180634@13561856@1339425499@B315A0E29D16C6FD92EE... HOST=10.0.0.1 FINGERPRINT=469bb424ec8835944d30bc77c77e8fc1d8e23a42 Thus, you can invoke openconnect as a non-privileged user (with access to the user's PKCS#11 tokens, etc.)  for authentication, and then invoke openconnect separately to make the actual connection as root: eval `openconnect --authenticate https://vpnserver.example.com`; [ -n $COOKIE ] && echo $COOKIE | sudo openconnect --cookie-on-stdin $HOST --servercert $FINGERPRINT
--cookieonly Fetch and print cookie only; don't connect
--printcookie Print cookie before connecting
--cafile=FILE Additional CA file for server verification. By default, this simply causes OpenConnect to trust additional root CA certificate(s) in addition to those trusted by the system. Use --no-system-trust to prevent OpenConnect from trusting the system default certificate authorities.
--no-system-trust Do not trust the system default certificate authorities. If this option is given, only certificate authorities given with the --cafile option, if any, will be trusted automatically.
--disable-ipv6 Do not advertise IPv6 capability to server
--dtls-ciphers=LIST Set OpenSSL ciphers to support for DTLS
--dtls12-ciphers=LIST Set OpenSSL ciphers for Cisco's DTLS v1.2
--dtls-local-port=PORT Use PORT as the local port for DTLS and UDP datagrams
--dump-http-traffic Enable verbose output of all HTTP requests and the bodies of all responses received from the server.
--pfs  Enforces Perfect Forward Secrecy (PFS). That ensures that if the server's long-term key is compromised, any session keys established before the compromise will be unaffected. If this option is provided and the server does not support PFS in the TLS channel the connection will fail.
PFS is available in Cisco ASA releases 9.1(2) and higher; a suitable cipher suite may need to be manually enabled by the administrator using the ssl encryption setting.
--no-dtls Disable DTLS and ESP
--no-http-keepalive Version 8.2.2.5 of the Cisco ASA software has a bug where it will forget the client's SSL certificate when HTTP connections are being re-used for multiple requests. So far, this has only been seen on the initial connection, where the server gives an HTTP/1.0 redirect response with an explicit Connection: Keep-Alive directive. OpenConnect as of v2.22 has an unconditional workaround for this, which is never to obey that directive after an HTTP/1.0 response.
However, Cisco's support team has failed to give any competent response to the bug report and we don't know under what other circumstances their bug might manifest itself. So this option exists to disable ALL re-use of HTTP sessions and cause a new connection to be made for each request. If your server seems not to be recognising your certificate, try this option. If it makes a difference, please report this information to the openconnect-devel@lists.infradead.org mailing list.
--no-passwd Never attempt password (or SecurID) authentication.
--no-xmlpost Do not attempt to post an XML authentication/configuration request to the server; use the old style GET method which was used by older clients and servers instead.
This option is a temporary safety net, to work around potential compatibility issues with the code which falls back to the old method automatically. It causes OpenConnect to behave more like older versions (4.08 and below) did. If you find that you need to use this option, then you have found a bug in OpenConnect. Please see http://www.infradead.org/openconnect/mail.html and report this to the developers.
--non-inter Do not expect user input; exit if it is required.
--passwd-on-stdin Read password from standard input
--protocol=PROTO Select VPN protocol PROTO to be used for the connection. Supported protocols are anyconnect for Cisco AnyConnect (the default), nc for experimental support for Juniper Network Connect (also supported by most Junos Pulse servers), pulse for experimental support for Junos Pulse, and gp for experimental support for PAN GlobalProtect.
OpenConnect does not yet support all of the authentication options used by Pulse, nor does it support Host Checker/TNCC with Pulse. If your Junos Pulse VPN is not yet supported with --protocol=pulse, then --protocol=nc may be a useful fallback option.
--token-mode=MODE Enable one-time password generation using the MODE algorithm. --token-mode=rsa will call libstoken to generate an RSA SecurID tokencode, --token-mode=totp will call liboath to generate an RFC 6238 time-based password, and --token-mode=hotp will call liboath to generate an RFC 4226 HMAC-based password. Yubikey tokens which generate OATH codes in hardware are supported with --token-mode=yubioath. --token-mode=oidc will use the provided OpenIDConnect token as an RFC 6750 bearer token.
--token-secret={ SECRET[,COUNTER] | @FILENAME } The secret to use when generating one-time passwords/verification codes.  Base 32-encoded TOTP/HOTP secrets can be used by specifying "base32:" at the beginning of the secret, and for HOTP secrets the token counter can be specified following a comma.
RSA SecurID secrets can be specified as an Android/iPhone URI or a raw numeric CTF string (with or without dashes).
For Yubikey OATH the token secret specifies the name of the credential to be used. If not provided, the first OATH credential found on the device will be used.
For OIDC the secret is the bearer token to be used.
FILENAME, if specified, can contain any of the above strings.  Or, it can contain a SecurID XML (SDTID) seed.
If this option is omitted, and --token-mode is "rsa", libstoken will try to use the software token seed saved in ~/.stokenrc by the "stoken import" command.
--reconnect-timeout Keep reconnect attempts until so much seconds are elapsed. The default timeout is 300 seconds, which means that openconnect can recover VPN connection after a temporary network down time of 300 seconds.
--resolve=HOST:IP Automatically resolve the hostname HOST to IP instead of using the normal resolver to look it up.
--servercert=HASH Accept server's SSL certificate only if the provided fingerprint matches.  The allowed fingerprint types are SHA1, SHA256, and PIN- SHA256.  They are distinguished by the 'sha1:', 'sha256:' and 'pin-sha256:' prefixes to the encoded hash. The first two are custom identifiers providing hex encoding of the peer's public key, while 'pin-sha256:' is the RFC7469 key PIN, which utilizes base64 encoding. To ease certain testing use-cases, a partial match of the hash will also be accepted, if it is at least 4 characters past the prefix.
--useragent=STRING Use STRING as 'User-Agent:' field value in HTTP header.  (e.g. --useragent 'Cisco AnyConnect VPN Agent for Windows 2.2.0133')
--version-string=STRING Use STRING as the software version reported to the head end. (e.g. --version-string '2.2.0133')
--local-hostname=STRING Use STRING as 'X-CSTP-Hostname:' field value in HTTP header. For example --local-hostname 'mypc', will advertise the value 'mypc' as the suggested hostname to point to the provided IP address.
--os=STRING OS type to report to gateway.  Recognized values are: linux, linux-64, win, mac-intel, android, apple-ios.  Reporting a different OS type may affect the dynamic access policy (DAP) applied to the VPN session.  If the gateway requires CSD, it will also cause the corresponding CSD trojan binary to be downloaded, so you may need to use --csd-wrapper if this code is not executable on the local machine.
In the data phase of the connection, the following signals are handled:
SIGINT / SIGTERM performs a clean shutdown by logging the session off, disconnecting from the gateway, and running the vpnc-script to restore the network configuration.
SIGHUP disconnects from the gateway and runs the vpnc-script, but does not log the session off; this allows for reconnection later using --cookie.
SIGUSR2 forces an immediate disconnection and reconnection; this can be used to quickly recover from LAN IP address changes.
LIMITATIONS Note that although IPv6 has been tested on all platforms on which openconnect is known to run, it depends on a suitable vpnc-script to configure the network. The standard vpnc-script shipped with vpnc 0.5.3 is not capable of setting up IPv6 routes; the one from git://git.infradead.org/users/dwmw2/vpnc-scripts.git will be required.
ocserv(8)
David Woodhouse <dwmw2@infradead.org>
DEBSECAN(1)                                                          DEBSECAN(1)
debsecan - Debian Security Analyzer
debsecan options...
debsecan analyzes the list of installed packages on the current host and reports vulnerabilities found on the system.
--suite count Choose a specific suite.  debsecan produces more informative output (including obsolete packages) if the correct suite is specified.  The release code name has to be used ("sid"), not the temporal name ("unstable").
--whitelist file Change the name of the whitelist file.
--add-whitelist, --remove-whitelist, --show-whitelist Add or remove entries from the whitelist, or print the whitelist to standard output.  See the CHANGING THE WHITELIST section below.
--source url Override the default download URL for vulnerability data.
--status file Evaluate a different dpkg status file.
--format format Change the output format.  If format is summary (the default), a short summary for each vulnerability is printed.  The simple format is like the summary format, except that only the bug packages names are printed.  For bugs and packages, debsecan lists the names of vulnerabilities and binary packages, respectively. --format detail requests a verbose output format, showing all available data.  The report format is used for email reports.
--line-length characters Specifies the line length in report mode.  The default is 72.
--mailto mailbox The --mailto option instructions debsecan to the send the report to the email address mailbox.  No report is sent if there where no changes since the last invocation with --update-history.  This option requires the --format report output format.  The option value may contain macros, see the section CONFIGURATION FILE MACROS below.
--only-fixed Only list vulnerabilities for which a fix is available in the archive.  Note that it can happen that a fix is listed, although the package has not been built for the system's architecture and is not yet available for download.  (If you use this option, you also must specify the correct suite using --suite.)
--no-obsolete Do not list any obsolete packages (see below).  Using this option is not recommended because it hides real vulnerabilities on some systems, not just false positives.
--history file Change the name of the history file used by --format report.
--disable-https-check Turn off certificate validation for HTTPS.
--update-history Update the vulnerability status information after reporting it using --format report.
--cron Internal option used for invocations from cron.  Checks if the vulnerability data has already been downloaded today.  In this case, further processing is skipped.  See debsecan-create-cron(8) for instructions how to create a suitable cron entry.
--config file Sets the location of the configuration file.
--help Display a short help message and exit.
The configuration file contains the following variables.  It follows name=value shell syntax.  If value contains white space, it must be surrounded by double quotes.  Some variables may contain macros; see the section CONFIGURATION FILE MACROS below.
MAILTO Sets the email address to which reports are sent in --cron mode. May contain macros.
REPORT Controls whether debsecan does any processing whatsoever in --cron mode.  (Permitted values: true and false.)
SOURCE Controls the URL from which vulnerability information is fetched. If empty, the built-in default is used.
SUITE  Sets the default value of the --suite option (see there).
SUBJECT Changes the subject line of reports.  May contain macros.
DISABLE_HTTPS_CHECK Disables HTTPS certificate checking, just like the --disable- https-check command line option.
Macro processing replaces strings of the form %s(key)s with system- dependent values.  Support keys are:
hostname The host name on which debsecan runs, without the domain name part.
fqdn   The fully-qualified domain name of the host on which debsecan runs.
ip     The IP address of the host on which debsecan runs.  This may be inaccurate on multi-homed systems.
You can use the --add-whitelist and --remove-whitelist options to change the whitelist.  Whitelisted vulnerabilities are not included in the reports.  For example,
debsecan --add-whitelist CVE-2005-4601
ignores the vulnerability CVE-2005-4601 completely, while
debsecan --add-whitelist CVE-2005-4601 perlmagick
ignores it only as far as the perlmagick is concerned.  (This is the same format that is produced by the --format simple option.)  To remove all whitelist entries for the CVE-2005-4601 vulnerability, use:
debsecan --remove-whitelist CVE-2005-4601
If you want to remove an entry for a specific vulnerability/package pair, list the package name explicitly, as in:
debsecan --remove-whitelist CVE-2005-4601 imagemagick
You can list multiple vulnerability and packages.  For example,
debsecan --add-whitelist CVE-2005-4601 \ CVE-2006-0082 imagemagick perlmagick
whitelists CVE-2005-4601 for all packages, and CVE-2006-0082 for the imagemagick and perlmagick packages only.
Much like the official Debian security advisories, debsecan's vulnerability tracking is mostly based on source packages.  This can be confusing because tools like dpkg only display binary package names. Therefore, debsecan displays the more familiar binary package names. This has the unfortunate effect that all binary packages (including packages containing only documentation, for example) are flagged as vulnerable, and not only those packages which actually contain the vulnerable code.
If the correct --suite option is specified, debsecan may mark some packages as obsolete.  This means that the binary package in question has been removed from the archive.  In this case, you need to update all the packages depending on the obsolete package, and subsequently remove the obsolete package.
For certain architectures, build daemons may lag considerably.  In such case, debsecan may incorrectly mark a package as fixed, even if an update is not yet available in the Debian archive.
Note that debsecan version uses the --suite option only to determine the availability of corrected packages and to detect obsolete packages.  If you specify the wrong suite, only the information on available security updates and obsolete packages is wrong, but the list of vulnerabilities is correct.
Mixing packages from different Debian releases is supported, as long as the packages still carry their official version numbers.  Unknown package versions (from backported packages, for example) are compared to the version in Debian unstable only, which may lead to incorrect reports.
This command prints all package names for which security fixes are available:
debsecan --suite suite --format packages --only-fixed
If you pass this output to apt-get, you can download new packages which contain security fixes.  For example, if you are running sid:
apt-get install \ $(debsecan --suite sid --format packages --only-fixed)
The following command can be invoked periodically, to get notifications of new security issues:
debsecan --suite suite --format report \ --update-history --mailto root
See debsecan-create-cron(8) for a tool which creates a suitable cron entry.
https_proxy This environment variable instructs debsecan to use a proxy server to fetch the vulnerability data.  It must be of the form http://proxy.example.net:8080/ (mimicking a URL).
/etc/default/debsecan Built-in location of the configuration file.
/var/lib/dpkg/status File from which the package information is fetched by default.
debsecan was written by Florian Weimer.
dpkg(1), debsecan-create-cron(8), apt-get(8)
POSTFIX(1)                   General Commands Manual                  POSTFIX(1)
postfix - Postfix control program
postfix [-Dv] [-c config_dir] command
This command is reserved for the superuser. To submit mail, use the Postfix sendmail(1) command.
The postfix(1) command controls the operation of the Postfix mail system: start or stop the master(8) daemon, do a health check, and other maintenance.
By default, the postfix(1) command sets up a standardized environment and runs the postfix-script shell script to do the actual work.
However, when support for multiple Postfix instances is configured, postfix(1) executes the command specified with the multi_instance_wrapper configuration parameter.  This command will execute the command for each applicable Postfix instance.
The following commands are implemented:
check  Warn about bad directory/file ownership or permissions, and create missing directories.
start  Start the Postfix mail system. This also runs the configuration check described above.
start-fg Like start, but keep the master(8) daemon running in the foreground, and enable master(8) "init" mode when running as PID 1.  This command requires that multi-instance support is disabled (i.e. the multi_instance_directories parameter value must be empty).
When running Postfix inside a container, see MAILLOG_README for logging to stdout. Postfix logs to syslog by default, which requires a) running a syslogd process inside the container, or b) mounting the container host's /dev/log socket inside the container (example: "docker run -v /dev/log:/dev/log ..."), and c) a distinct Postfix "syslog_name" prefix that identifies logging from the Postfix instance.
stop   Stop the Postfix mail system in an orderly fashion. If possible, running processes are allowed to terminate at their earliest convenience.
Note: in order to refresh the Postfix mail system after a configuration change, do not use the start and stop commands in succession. Use the reload command instead.
abort  Stop the Postfix mail system abruptly. Running processes are signaled to stop immediately.
flush  Force delivery: attempt to deliver every message in the deferred mail queue. Normally, attempts to deliver delayed mail happen at regular intervals, the interval doubling after each failed attempt.
Warning: flushing undeliverable mail frequently will result in poor delivery performance of all other mail.
reload Re-read configuration files. Running processes terminate at their earliest convenience.
status Indicate if the Postfix mail system is currently running.
set-permissions [name=value ...] Set the ownership and permissions of Postfix related files and directories, as specified in the postfix-files file.
Specify name=value to override and update specific main.cf configuration parameters. Use this, for example, to change the mail_owner or setgid_group setting for an already installed Postfix system.
This feature is available in Postfix 2.1 and later.  With Postfix 2.0 and earlier, use "$config_directory/post-install set-permissions".
logrotate Rotate the logfile specified with $maillog_file, by appending a time-stamp suffix that is formatted according to $maillog_file_rotate_suffix, and by compressing the file with the command specified with $maillog_file_compressor.  This will not rotate /dev/* files.
This feature is available in Postfix 3.4 and later.
tls subcommand Enable opportunistic TLS in the Postfix SMTP client or server, and manage Postfix SMTP server TLS private keys and certificates.  See postfix-tls(1) for documentation.
This feature is available in Postfix 3.1 and later.
upgrade-configuration [name=value ...] Update the main.cf and master.cf files with information that Postfix needs in order to run: add or update services, and add or update configuration parameter settings.
Specify name=value to override and update specific main.cf configuration parameters.
This feature is available in Postfix 2.1 and later.  With Postfix 2.0 and earlier, use "$config_directory/post-install upgrade-configuration".
The following options are implemented:
-c config_dir Read the main.cf and master.cf configuration files in the named directory instead of the default configuration directory.  Use this to distinguish between multiple Postfix instances on the same host.
With Postfix 2.6 and later, this option forces the postfix(1) command to operate on the specified Postfix instance only.  This behavior is inherited by postfix(1) commands that run as a descendant of the current process.
-D (with postfix start only) Run each Postfix daemon under control of a debugger as specified via the debugger_command configuration parameter.
-v     Enable verbose logging for debugging purposes. Multiple -v options make the software increasingly verbose.
The postfix(1) command exports the following environment variables before executing the postfix-script file:
MAIL_CONFIG This is set when the -c command-line option is present.
With Postfix 2.6 and later, this environment variable forces the postfix(1) command to operate on the specified Postfix instance only.  This behavior is inherited by postfix(1) commands that run as a descendant of the current process.
MAIL_VERBOSE This is set when the -v command-line option is present.
MAIL_DEBUG This is set when the -D command-line option is present.
When the internal logging service is enabled (by setting a non-empty maillog_file parameter value) the postfix(1) command exports settings that are used by child processes before they have processed main.cf or command-line settings.
POSTLOG_SERVICE The name of the public postlog service endpoint.
POSTLOG_HOSTNAME The hostname to prepend to internal logging.
The following main.cf configuration parameters are exported as environment variables with the same names:
config_directory (see 'postconf -d' output) The default location of the Postfix main.cf and master.cf configuration files.
command_directory (see 'postconf -d' output) The location of all postfix administrative commands.
daemon_directory (see 'postconf -d' output) The directory with Postfix support programs and daemon programs.
html_directory (see 'postconf -d' output) The location of Postfix HTML files that describe how to build, configure or operate a specific Postfix subsystem or feature.
mail_owner (postfix) The UNIX system account that owns the Postfix queue and most Postfix daemon processes.
mailq_path (see 'postconf -d' output) Sendmail compatibility feature that specifies where the Postfix mailq(1) command is installed.
manpage_directory (see 'postconf -d' output) Where the Postfix manual pages are installed.
newaliases_path (see 'postconf -d' output) Sendmail compatibility feature that specifies the location of the newaliases(1) command.
queue_directory (see 'postconf -d' output) The location of the Postfix top-level queue directory.
readme_directory (see 'postconf -d' output) The location of Postfix README files that describe how to build, configure or operate a specific Postfix subsystem or feature.
sendmail_path (see 'postconf -d' output) A Sendmail compatibility feature that specifies the location of the Postfix sendmail(1) command.
setgid_group (postdrop) The group ownership of set-gid Postfix commands and of group-writable Postfix directories.
Available in Postfix version 2.5 and later:
data_directory (see 'postconf -d' output) The directory with Postfix-writable data files (for example: caches, pseudo-random numbers).
Available in Postfix version 3.0 and later:
compatibility_level (0) A safety net that causes Postfix to run with backwards-compatible default settings after an upgrade to a newer Postfix version.
meta_directory (see 'postconf -d' output) The location of non-executable files that are shared among multiple Postfix instances, such as postfix-files, dynamicmaps.cf, and the multi-instance template files main.cf.proto and master.cf.proto.
shlib_directory (see 'postconf -d' output) The location of Postfix dynamically-linked libraries (libpostfix-*.so), and the default location of Postfix database plugins (postfix-*.so) that have a relative pathname in the dynamicmaps.cf file.
Available in Postfix version 3.1 and later:
openssl_path (openssl) The location of the OpenSSL command line program openssl(1).
Other configuration parameters:
import_environment (see 'postconf -d' output) The list of environment parameters that a privileged Postfix process will import from a non-Postfix parent process, or name=value environment overrides.
syslog_facility (mail) The syslog facility of Postfix logging.
syslog_name (see 'postconf -d' output) A prefix that is prepended to the process name in syslog records, so that, for example, "smtpd" becomes "prefix/smtpd".
Available in Postfix version 2.6 and later:
multi_instance_directories (empty) An optional list of non-default Postfix configuration directories; these directories belong to additional Postfix instances that share the Postfix executable files and documentation with the default Postfix instance, and that are started, stopped, etc., together with the default Postfix instance.
multi_instance_wrapper (empty) The pathname of a multi-instance manager command that the postfix(1) command invokes when the multi_instance_directories parameter value is non-empty.
multi_instance_group (empty) The optional instance group name of this Postfix instance.
multi_instance_name (empty) The optional instance name of this Postfix instance.
multi_instance_enable (no) Allow this Postfix instance to be started, stopped, etc., by a multi-instance manager.
Available in Postfix version 3.4 and later:
maillog_file (empty) The name of an optional logfile that is written by the Postfix postlogd(8) service.
maillog_file_compressor (gzip) The program to run after rotating $maillog_file with "postfix logrotate".
maillog_file_prefixes (/var, /dev/stdout) A list of allowed prefixes for a maillog_file value.
maillog_file_rotate_suffix (%Y%m%d-%H%M%S) The format of the suffix to append to $maillog_file while rotating the file with "postfix logrotate".
postlog_service_name (postlog) The name of the postlogd(8) service entry in master.cf.
Prior to Postfix version 2.6, all of the following files were in $config_directory. Some files are now in $daemon_directory or $meta_directory so that they can be shared among multiple instances that run the same Postfix version.
Use the command "postconf config_directory" or "postconf daemon_directory" to expand the names into their actual values.
$config_directory/main.cf, Postfix configuration parameters $config_directory/master.cf, Postfix daemon processes $daemon_directory/postfix-script, administrative commands $daemon_directory/post-install, post-installation configuration $meta_directory/dynamicmaps.cf, plug-in database clients $meta_directory/postfix-files, file/directory permissions
Commands: postalias(1), create/update/query alias database postcat(1), examine Postfix queue file postconf(1), Postfix configuration utility postfix(1), Postfix control program postfix-tls(1), Postfix TLS management postkick(1), trigger Postfix daemon postlock(1), Postfix-compatible locking postlog(1), Postfix-compatible logging postmap(1), Postfix lookup table manager postmulti(1), Postfix multi-instance manager postqueue(1), Postfix mail queue control postsuper(1), Postfix housekeeping mailq(1), Sendmail compatibility interface newaliases(1), Sendmail compatibility interface sendmail(1), Sendmail compatibility interface
Postfix configuration: bounce(5), Postfix bounce message templates master(5), Postfix master.cf file syntax postconf(5), Postfix main.cf file syntax postfix-wrapper(5), Postfix multi-instance API
Table-driven mechanisms: access(5), Postfix SMTP access control table aliases(5), Postfix alias database canonical(5), Postfix input address rewriting generic(5), Postfix output address rewriting header_checks(5), body_checks(5), Postfix content inspection relocated(5), Users that have moved transport(5), Postfix routing table virtual(5), Postfix virtual aliasing
Table lookup mechanisms: cidr_table(5), Associate CIDR pattern with value ldap_table(5), Postfix LDAP client lmdb_table(5), Postfix LMDB database driver memcache_table(5), Postfix memcache client mysql_table(5), Postfix MYSQL client nisplus_table(5), Postfix NIS+ client pcre_table(5), Associate PCRE pattern with value pgsql_table(5), Postfix PostgreSQL client regexp_table(5), Associate POSIX regexp pattern with value socketmap_table(5), Postfix socketmap client sqlite_table(5), Postfix SQLite database driver tcp_table(5), Postfix client-server table lookup
Daemon processes: anvil(8), Postfix connection/rate limiting bounce(8), defer(8), trace(8), Delivery status reports cleanup(8), canonicalize and enqueue message discard(8), Postfix discard delivery agent dnsblog(8), DNS allow/denylist logger error(8), Postfix error delivery agent flush(8), Postfix fast ETRN service local(8), Postfix local delivery agent master(8), Postfix master daemon oqmgr(8), old Postfix queue manager pickup(8), Postfix local mail pickup pipe(8), deliver mail to non-Postfix command postlogd(8), Postfix internal logging service postscreen(8), Postfix zombie blocker proxymap(8), Postfix lookup table proxy server qmgr(8), Postfix queue manager qmqpd(8), Postfix QMQP server scache(8), Postfix connection cache manager showq(8), list Postfix mail queue smtp(8), lmtp(8), Postfix SMTP+LMTP client smtpd(8), Postfix SMTP server spawn(8), run non-Postfix server tlsmgr(8), Postfix TLS cache and randomness manager tlsproxy(8), Postfix TLS proxy server trivial-rewrite(8), Postfix address rewriting verify(8), Postfix address verification virtual(8), Postfix virtual delivery agent
Other: syslogd(8), system logging
Use "postconf readme_directory" or "postconf html_directory" to locate this information. OVERVIEW, overview of Postfix commands and processes BASIC_CONFIGURATION_README, Postfix basic configuration ADDRESS_REWRITING_README, Postfix address rewriting SMTPD_ACCESS_README, SMTP relay/access control CONTENT_INSPECTION_README, Postfix content inspection QSHAPE_README, Postfix queue analysis
The Secure Mailer license must be distributed with this software.
AUTHOR(S) Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA
Wietse Venema Google, Inc. 111 8th Avenue New York, NY 10011, USA
TLS support by: Lutz Jaenicke Brandenburg University of Technology Cottbus, Germany
Victor Duchovni Morgan Stanley
SASL support originally by: Till Franke SuSE Rhein/Main AG 65760 Eschborn, Germany
LMTP support originally by: Philip A. Prindeville Mirapoint, Inc. USA.
Amos Gouaux University of Texas at Dallas P.O. Box 830688, MC34 Richardson, TX 75083, USA
IPv6 support originally by: Mark Huizer, Eindhoven University, The Netherlands Jun-ichiro 'itojun' Hagino, KAME project, Japan The Linux PLD project Dean Strik, Eindhoven University, The Netherlands
DPKG-QUERY(8)                      dpkg suite                      DPKG-QUERY(8)
dpkg-query - a tool to query the dpkg database
dpkg-query
dpkg-query is a tool to show information about packages listed in the dpkg database.
-l | --list package-name-pattern ... List packages matching given pattern. If no package-name-pattern is given, list all packages in /var/lib/dpkg/status.  Normal shell wildchars are allowed in package-name-pattern. Please note you will probably have to quote package-name-pattern to prevent the shell from performing filename expansion. For example this will list all package names starting with “libc5”:
dpkg-query -l 'libc5*'
-W | --show package-name-pattern ... Just like the --list option this will list all packages matching the given pattern. However the output can be customized using the --showformat option.
-s | --status package-name ... Report status of specified package. This just displays the entry in the installed package status database.
-L | --listfiles package ... List files installed to your system from package.  However, note that files created by package-specific installation-scripts are not listed.
-S | --search filename-search-pattern ... Search for a filename from installed packages. All standard shell wildchars can be used in the pattern.  This command will not list extra files created by maintainer scripts, nor will it list alternatives.
-p |--print-avail package Display details about package, as found in /var/lib/dpkg/available.
--licence | --license Display licence and copyright information.
--admindir=dir Change the location of the dpkg database. The default location is /var/lib/dpkg.
--showformat=format This option is used to specify the format of the output --show will produce.  The format is a string that will be output for each package listed. It can include the standard escape sequences \n (newline), \r (carriage return) or \\ (plain backslash). Package information can be included by inserting variable references to package fields using the ${var[;width]} syntax. Fields are printed be right-aligned unless the width is negative in which case left alignment will be used.
COLUMNS This setting influences the output of the --list option by changing the width of its output.
Copyright 2001 Wichert Akkerman <wakkerma@debian.org> ⟨mailto:wakkerma@debian.org⟩
This is free software; see the GNU General Public Licence version 2 or later for copying conditions.  There is NO warranty.
dpkg(8)
nix(1)                       General Commands Manual                      nix(1)
Warning: This program is experimental and its interface is subject to change.
Name nix - a tool for reproducible and declarative configuration management
Synopsis nix [option…] subcommand
where subcommand is one of the following:
Main commands:
• nix build (./nix3-build.md) - build a derivation or fetch a store path • nix develop (./nix3-develop.md) - run a bash shell that provides the build environment of a derivation • nix flake (./nix3-flake.md) - manage Nix flakes • nix help (./nix3-help.md) - show help about nix or a particular subcommand • nix profile (./nix3-profile.md) - manage Nix profiles • nix repl (./nix3-repl.md) - start an interactive environment for evaluating Nix expressions • nix run (./nix3-run.md) - run a Nix application • nix search (./nix3-search.md) - search for packages • nix shell (./nix3-shell.md) - run a shell in which the specified packages are available
Infrequently used commands:
• nix bundle (./nix3-bundle.md) - bundle an application so that it works outside of the Nix store • nix copy (./nix3-copy.md) - copy paths between Nix stores • nix edit (./nix3-edit.md) - open the Nix expression of a Nix package in $EDITOR • nix eval (./nix3-eval.md) - evaluate a Nix expression • nix log (./nix3-log.md) - show the build log of the specified packages or paths, if available • nix path-info (./nix3-path-info.md) - query information about store paths • nix registry (./nix3-registry.md) - manage the flake registry • nix why-depends (./nix3-why-depends.md) - show why a package has another package in its closure
Utility/scripting commands:
• nix daemon (./nix3-daemon.md) - daemon to perform store operations on behalf of non-root clients • nix describe-stores (./nix3-describe-stores.md) - show registered store types and their available options • nix hash (./nix3-hash.md) - compute and convert cryptographic hashes • nix key (./nix3-key.md) - generate and convert Nix signing keys • nix nar (./nix3-nar.md) - create or inspect NAR files • nix print-dev-env (./nix3-print-dev-env.md) - print shell code that can be sourced by bash to reproduce the build environment of a derivation • nix realisation (./nix3-realisation.md) - manipulate a Nix realisation • nix show-config (./nix3-show-config.md) - show the Nix configuration • nix show-derivation (./nix3-show-derivation.md) - show the contents of a store derivation • nix store (./nix3-store.md) - manipulate a Nix store
Commands for upgrading or troubleshooting your Nix installation:
• nix doctor (./nix3-doctor.md) - check your system for potential problems and print a PASS or FAIL for each check • nix upgrade-nix (./nix3-upgrade-nix.md) - upgrade Nix to the latest stable version
Examples • Create a new flake:
# nix flake new hello # cd hello
• Build the flake in the current directory:
# nix build # ./result/bin/hello Hello, world!
• Run the flake in the current directory:
# nix run Hello, world!
• Start a development shell for hacking on this flake:
# nix develop # unpackPhase # cd hello-* # configurePhase # buildPhase # ./hello Hello, world! # installPhase # ../outputs/out/bin/hello Hello, world!
Description Nix is a tool for building software, configurations and other artifacts in a reproducible and declarative way. For more information, see the Nix homepage (https://nixos.org/) or the Nix manual (https://nixos.org/manual/nix/stable/).
Installables Many nix subcommands operate on one or more installables. These are command line arguments that represent something that can be built in the Nix store. Here are the recognised types of installables:
• Flake output attributes: nixpkgs#hello
These have the form flakeref[#attrpath], where flakeref is a flake reference and attrpath is an optional attribute path. For more information on flakes, see the nix flake manual page (./nix3-flake.md). Flake references are most commonly a flake identifier in the flake registry (e.g. nixpkgs) or a path (e.g. /path/to/my-flake or .).
If attrpath is omitted, Nix tries some default values; for most subcommands, the default is defaultPackage.system (e.g. defaultPackage.x86_64-linux), but some subcommands have other defaults. If attrpath is specified, attrpath is interpreted as relative to one or more prefixes; for most subcommands, these are packages.system, legacyPackages.*system* and the empty prefix. Thus, on x86_64-linux nix build nixpkgs#hello will try to build the attributes packages.x86_64-linux.hello, legacyPackages.x86_64-linux.hello and hello.
• Store paths: /nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10
These are paths inside the Nix store, or symlinks that resolve to a path in the Nix store.
• Store derivations: /nix/store/p7gp6lxdg32h4ka1q398wd9r2zkbbz2v- hello-2.10.drv
Store derivations are store paths with extension .drv and are a low- level representation of a build-time dependency graph used internally by Nix. By default, if you pass a store derivation to a nix subcommand, it will operate on the output paths of the derivation. For example, nix path-info prints information about the output paths:
# nix path-info --json /nix/store/p7gp6lxdg32h4ka1q398wd9r2zkbbz2v-hello-2.10.drv [{"path":"/nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10",…}]
If you want to operate on the store derivation itself, pass the --derivation flag.
• Nix attributes: --file /path/to/nixpkgs hello
When the -f / --file path option is given, installables are interpreted as attribute paths referencing a value returned by evaluating the Nix file path.
• Nix expressions: --expr '(import <nixpkgs> {}).hello.overrideDerivation (prev: { name = "my-hello"; })'.
When the --expr option is given, all installables are interpreted as Nix expressions. You may need to specify --impure if the expression references impure inputs (such as <nixpkgs>).
For most commands, if no installable is specified, the default is ., i.e. Nix will operate on the default flake output attribute of the flake in the current directory.
Nix stores Most nix subcommands operate on a Nix store.
TODO: list store types, options
Options • --help Show usage information.
• --offline Disable substituters and consider all previously downloaded files up- to-date.
• --option name value Set the Nix configuration setting name to value (overriding nix.conf).
• --refresh Consider all previously downloaded files out-of-date.
• --version Show version information.
Logging-related options:
• --debug Set the logging verbosity level to ‘debug’.
• --log-format format Set the format of log output; one of raw, internal-json, bar or bar- with-logs.
• --print-build-logs / -L Print full build logs on standard error.
• --quiet Decrease the logging verbosity level.
• --verbose / -v Increase the logging verbosity level.
Options to override configuration settings:
• --access-tokens value Set the access-tokens setting.
• --allow-dirty Enable the allow-dirty setting.
• --allow-import-from-derivation Enable the allow-import-from-derivation setting.
• --allow-new-privileges Enable the allow-new-privileges setting.
• --allow-symlinked-store Enable the allow-symlinked-store setting.
• --allow-unsafe-native-code-during-evaluation Enable the allow-unsafe-native-code-during-evaluation setting.
• --allowed-impure-host-deps value Set the allowed-impure-host-deps setting.
• --allowed-uris value Set the allowed-uris setting.
• --allowed-users value Set the allowed-users setting.
• --auto-optimise-store Enable the auto-optimise-store setting.
• --bash-prompt value Set the bash-prompt setting.
• --bash-prompt-suffix value Set the bash-prompt-suffix setting.
• --build-hook value Set the build-hook setting.
• --build-poll-interval value Set the build-poll-interval setting.
• --build-users-group value Set the build-users-group setting.
• --builders value Set the builders setting.
• --builders-use-substitutes Enable the builders-use-substitutes setting.
• --compress-build-log Enable the compress-build-log setting.
• --connect-timeout value Set the connect-timeout setting.
• --cores value Set the cores setting.
• --diff-hook value Set the diff-hook setting.
• --download-attempts value Set the download-attempts setting.
• --enforce-determinism Enable the enforce-determinism setting.
• --eval-cache Enable the eval-cache setting.
• --experimental-features value Set the experimental-features setting.
• --extra-access-tokens value Append to the access-tokens setting.
• --extra-allowed-impure-host-deps value Append to the allowed-impure-host-deps setting.
• --extra-allowed-uris value Append to the allowed-uris setting.
• --extra-allowed-users value Append to the allowed-users setting.
• --extra-experimental-features value Append to the experimental-features setting.
• --extra-extra-platforms value Append to the extra-platforms setting.
• --extra-hashed-mirrors value Append to the hashed-mirrors setting.
• --extra-nix-path value Append to the nix-path setting.
• --extra-platforms value Set the extra-platforms setting.
• --extra-plugin-files value Append to the plugin-files setting.
• --extra-sandbox-paths value Append to the sandbox-paths setting.
• --extra-secret-key-files value Append to the secret-key-files setting.
• --extra-substituters value Append to the substituters setting.
• --extra-system-features value Append to the system-features setting.
• --extra-trusted-public-keys value Append to the trusted-public-keys setting.
• --extra-trusted-substituters value Append to the trusted-substituters setting.
• --extra-trusted-users value Append to the trusted-users setting.
• --fallback Enable the fallback setting.
• --filter-syscalls Enable the filter-syscalls setting.
• --flake-registry value Set the flake-registry setting.
• --fsync-metadata Enable the fsync-metadata setting.
• --gc-reserved-space value Set the gc-reserved-space setting.
• --hashed-mirrors value Set the hashed-mirrors setting.
• --http-connections value Set the http-connections setting.
• --http2 Enable the http2 setting.
• --impersonate-linux-26 Enable the impersonate-linux-26 setting.
• --keep-build-log Enable the keep-build-log setting.
• --keep-derivations Enable the keep-derivations setting.