neulab/tldr huggingface dataset:
isosize - output the length of an iso9660 filesystem
isosize [options] iso9660_image_file
This command outputs the length of an iso9660 filesystem that is contained in the specified file. This file may be a normal file or a block device (e.g. /dev/hdd or /dev/sr0). In the absence of any options (and errors), it will output the size of the iso9660 filesystem in bytes. This can now be a large number (>> 4 GB).
-x, --sectors Show the block count and block size in human-readable form. The output uses the term "sectors" for "blocks".
-d, --divisor number Only has an effect when -x is not given. The value shown (if no errors) is the iso9660 file size in bytes divided by number. So if number is the block size then the shown value will be the block count.
The size of the file (or block device) holding an iso9660 filesystem can be marginally larger than the actual size of the iso9660 filesystem. One reason for this is that cd writers are allowed to add "run out" sectors at the end of an iso9660 image.
1 generic failure, such as invalid usage
32 all failed
64 some failed
The isosize command is part of the util-linux package which can be downloaded from Linux Kernel Archive <https://www.kernel.org/pub/linux/utils/util-linux/>.
MEDUSA(1)                    General Commands Manual                   MEDUSA(1)
MEDUSA - Parallel Network Login Auditor
medusa [-h host|-H file] [-u username|-U file] [-p password|-P file] [-C file] -M module [OPTIONS]
Medusa is intended to be a speedy, massively parallel, modular, login brute-forcer.  The goal is to support as many services which allow remote authentication as possible. The author considers following items to some of the key features of this application:
*Thread-based parallel testing. Brute-force testing can be performed against multiple hosts, users or passwords concurrently.
*Flexible user input. Target information (host/user/password) can be specified in a variety of ways. For example, each item can be either a single entry or a file containing multiple entries. Additionally, a combination file format allows the user to refine their target listing.
*Modular design. Each service module exists as an independent .mod file. This means that no modifications are necessary to the core application in order to extend the supported list of services for brute-forcing.
-h [TARGET] Target hostname or IP address.
-H [FILE] Reads target specifications from the file specified rather than from the command line.  The file should contain a list separated by newlines.
-u [TARGET] Target username.
-U [FILE] Reads target usernames from the file specified rather than from the command line.  The file should contain a list separated by newlines.
-p [TARGET] Target password.
-P [FILE] Reads target passwords from the file specified rather than from the command line.  The file should contain a list separated by newlines.
-C [FILE] File containing combo entries. Combo files are colon separated and in the following format: host:user:password. If any of the three fields are left empty, the respective information should be provided either as a single global value or as a list in a file.
The following combinations are possible in the combo file: 1.) foo:bar:fud 2.) foo:bar: 3.) foo:: 4.) :bar:fud 5.) :bar: 6.) ::fud 7.) foo::fud
Medusa also supports using PwDump files as a combo file. The format of these files should be user:id:lm:ntlm:::. We look for ':::' at the end of the first line to determine if the file contains PwDump output.
-O [FILE] File to append log information to. Medusa will log all accounts credentials found to be valid or cause an unknown error. It will also log the start and stop times of an audit, along with the calling parameters.
-e [n/s/ns] Additional password checks ([n] No Password, [s] Password = Username). If both options are being used, they should be specified together ("-e ns"). If only a single option is being called use either "-e n" or "-e s".
-M [TEXT] Name of the module to execute (without the .mod extension).
-m [TEXT] Parameter to pass to the module. This can be passed multiple times with a different parameter each time and they will all be sent to the module (i.e.  -m Param1 -m Param2, etc.)
-d     Dump all known modules.
-n [NUM] Use for non-default TCP port number.
-s     Enable SSL.
-g [NUM] Give up after trying to connect for NUM seconds (default 3).
-r [NUM] Sleep NUM seconds between retry attempts (default 3).
-R [NUM] Attempt NUM retries before giving up. The total number of attempts will be NUM + 1.
-c [NUM] Set the number of usec that are waited during a test of the established network socket. Some services (e.g. FTP, IMAP, POP3, and SMTP) may be configured to drop connections after an arbitrary number of failed logon attempts. We try to reuse the established connection to send authentication attempts until this disconnect occurs, at which point the connection is reestablished. To accomplish this, we check the socket to see if it's still alive before authenticating within select modules. The default is perform a 1 usec check. It may be necessary to specify much larger values. For example, a 1000 usec was needed against our test vsftp server to avoid issues with its built-in anti-bruteforce mechanisms.
-t [NUM] Total number of logins to be tested concurrently. It should be noted that rougly t x T threads could be running at any one time. 381 appears to be the limit on my fairly boring Gentoo Linux host.
-T [NUM] Total number of hosts to be tested concurrently.
-L     Parallelize logins using one username per thread. The default is to process the entire username before proceeding.
-f     Stop scanning host after first valid username/password found.
-F     Stop audit after first valid username/password found on any host.
-b     Suppress startup banner
-q     Display module's usage information. This should be used in conjunction with the "-M" option. For example, "medusa -M smbnt -q".
-v [NUM] Verbose level [0 - 6 (more)]. All messages at or below the specified level will be displayed. The default level is 5.
The following is the breakdown of the verbose levels: 0)   EXIT APPLICATION 1)   MESSAGE WITHOUT TAG 2)   LOG MESSAGE WITHOUT TAG 3)   IMPORTANT MESSAGE 4)   ACCOUNT FOUND 5)   ACCOUNT CHECK 6) GENERAL MESSAGE
-w [NUM] Error debug level [0 - 10 (more)]. All messages at or below the specified level will be displayed. The default level is 5.
The following is the breakdown of the error levels: 0)   FATAL 1) ALERT 2)   CRITICAL 3)   ERROR 4)   WARNING 5)   NOTICE 6)   INFO 7)   DEBUG 8)   DEBUG - AUDIT 9)   DEBUG - SERVER 10)  DEBUG - MODULE
-Z [TEXT] Allows basic resuming of a previous scan. The supplied parameter describes which hosts were completed, which were partially tested and which had not been started.  When Medusa receives a SIGINT, it will calculate and display a "resume map". This map can then be supplied to the next run. For example, "medusa [OPTIONS PREVIOUSLY USED] -Z h6u1u2h8.". In this particular example, hosts 1-5 were completed, host 6 was partially done (user 1 was partially completed and user 2 and beyond had not been started), host 7 was completed and host 8 and beyond had not been started.  Medusa will parse this map and skip hosts and users accordingly. It should be noted that only host and user-level, not password-level, resuming is supported. If a user had been previously started, but was not completed, it will be tested from the start of its respective password list.
JoMo-Kun <jmk@foofus.net> fizzgig <fizzgig@foofus.net>
Found a bug? Feel free to send in a patch.
APT-KEY(8)                             APT                            APT-KEY(8)
apt-key - Deprecated APT key management utility
apt-key [--keyring filename] {add filename | del keyid | export keyid | exportall | list | finger | adv | update | net-update | {-v | --version} | {-h | --help}}
apt-key is used to manage the list of keys used by apt to authenticate packages. Packages which have been authenticated using these keys will be considered trusted.
Use of apt-key is deprecated, except for the use of apt-key del in maintainer scripts to remove existing keys from the main keyring. If such usage of apt-key is desired the additional installation of the GNU Privacy Guard suite (packaged in gnupg) is required.
apt-key(8) will last be available in Debian 11 and Ubuntu 22.04.
apt-key supports only the binary OpenPGP format (also known as "GPG key public ring") in files with the "gpg" extension, not the keybox database format introduced in newer gpg(1) versions as default for keyring files. Binary keyring files intended to be used with any apt version should therefore always be created with gpg --export.
Alternatively, if all systems which should be using the created keyring have at least apt version >= 1.4 installed, you can use the ASCII armored format with the "asc" extension instead which can be created with gpg --armor --export.
add filename (deprecated) Add a new key to the list of trusted keys. The key is read from the filename given with the parameter filename or if the filename is - from standard input.
It is critical that keys added manually via apt-key are verified to belong to the owner of the repositories they claim to be for otherwise the apt-secure(8) infrastructure is completely undermined.
Note: Instead of using this command a keyring should be placed directly in the /etc/apt/trusted.gpg.d/ directory with a descriptive name and either "gpg" or "asc" as file extension.
del keyid (mostly deprecated) Remove a key from the list of trusted keys.
export keyid (deprecated) Output the key keyid to standard output.
exportall (deprecated) Output all trusted keys to standard output.
list, finger (deprecated) List trusted keys with fingerprints.
adv (deprecated) Pass advanced options to gpg. With adv --recv-key you can e.g. download key from keyservers directly into the trusted set of keys. Note that there are no checks performed, so it is easy to completely undermine the apt-secure(8) infrastructure if used without care.
update (deprecated) Update the local keyring with the archive keyring and remove from the local keyring the archive keys which are no longer valid. The archive keyring is shipped in the archive-keyring package of your distribution, e.g. the debian-archive-keyring package in Debian.
Note that a distribution does not need to and in fact should not use this command any longer and instead ship keyring files in the /etc/apt/trusted.gpg.d/ directory directly as this avoids a dependency on gnupg and it is easier to manage keys by simply adding and removing files for maintainers and users alike.
net-update (deprecated) Perform an update working similarly to the update command above, but get the archive keyring from a URI instead and validate it against a master key. This requires an installed wget(1) and an APT build configured to have a server to fetch from and a master keyring to validate. APT in Debian does not support this command, relying on update instead, but Ubuntu's APT does.
Note that options need to be defined before the commands described in the previous section.
--keyring filename (deprecated) With this option it is possible to specify a particular keyring file the command should operate on. The default is that a command is executed on the trusted.gpg file as well as on all parts in the trusted.gpg.d directory, though trusted.gpg is the primary keyring which means that e.g. new keys are added to this one.
/etc/apt/trusted.gpg Keyring of local trusted keys, new keys will be added here. Configuration Item: Dir::Etc::Trusted.
/etc/apt/trusted.gpg.d/ File fragments for the trusted keys, additional keyrings can be stored here (by other packages or the administrator). Configuration Item Dir::Etc::TrustedParts.
apt-get(8), apt-secure(8)
APT bug page[1]. If you wish to report a bug in APT, please see /usr/share/doc/debian/bug-reporting.txt or the reportbug(1) command.
APT was written by the APT team <apt@packages.debian.org>.
APT team
1. APT bug page http://bugs.debian.org/src:apt
PHAR(1)                           User Commands                          PHAR(1)
phar, phar.phar - PHAR (PHP archive) command line tool
phar <command> [options] ...
The PHAR file format provides a way to put entire PHP applications into a single file called a "phar" (PHP Archive) for easy distribution and installation.
With the phar command you can create, update or extract PHP archives.
Commands: add compress delete extract help help-list info list meta-del meta-get meta-set pack sign stub-get stub-set tree version
add command Add entries to a PHAR package.
Required arguments:
-f file        Specifies the phar file to work on.
...            Any number of input files and directories. If -i is in use then ONLY files and matching the given regular expression are being packed. If -x is given then files matching that regular expression are NOT being packed.
Optional arguments:
-a alias       Provide an alias name for the phar file.
-c algo        Compression algorithm (see COMPRESSION )
-i regex       Specifies a regular expression for input files.
-l level       Number of preceding subdirectories to strip from file entries
-x regex       Regular expression for input files to exclude.
compress command Compress or uncompress all files or a selected entry.
-e entry       Name of entry to work on (must include PHAR internal directory name if any).
delete command Delete entry from a PHAR archive
extract command Extract a PHAR package to a directory.
...            Directory to extract to (defaults to '.').
help command This help or help for a selected command.
...            Optional command to retrieve help for.
help-list command Lists available commands.
info command Get information about a PHAR package.
By using -k it is possible to return a single value.
-k index       Subscription index to work on.
list command List contents of a PHAR archive.
meta-del command Delete meta information of a PHAR entry or a PHAR package.
If -k is given then the metadata is expected to be an array and the given index is being deleted.
If something was deleted the return value is 0 otherwise it is 1.
meta-get command Get meta information of a PHAR entry or a PHAR package in serialized from. If no output file is specified for meta data then stdout is being used.  You can also specify a particular index using -k. In that case the metadata is expected to be an array and the value of the given index is returned using echo rather than using serialize. If that index does not exist or no meta data is present then the return value is 1.
meta-set command Set meta data of a PHAR entry or a PHAR package using serialized input. If no input file is specified for meta data then stdin is being used. You can also specify a particular index using -k. In that case the metadata is expected to be an array and the value of the given index is being set. If the metadata is not present or empty a new array will be created.  If the metadata is present and a flat value then the return value is 1. Also using -k the input is been taken directly rather then being serialized.
-m meta        Meta data to store with entry (serialized php data).
pack command Pack files into a PHAR archive.
When using -s <stub>, then the stub file is being excluded from the list of input files/dirs.To create an archive that contains PEAR class PHP_Archive then point -p argument to PHP/Archive.php.
-b bang        Hash-bang line to start the archive (e.g. #!/usr/bin/php). The hash mark itself '#!' and the newline character are optional.
-h hash        Selects the hash algorithm (see HASH )
-p loader      Location of PHP_Archive class file (pear list-files PHP_Archive).You can use '0' or '1' to locate it automatically using the mentioned pear command. When using '0' the command does not error out when the class file cannot be located. This switch also adds some code around the stub so that class PHP_Archive gets registered as phar:// stream wrapper if necessary. And finally this switch will add the file phar.inc from this package and load it to ensure class Phar is present.
-s stub        Select the stub file.
-y key         Private key for OpenSSL signing.
sign command Set signature hash algorithm.
stub-get command Get the stub of a PHAR file. If no output file is specified as stub then stdout is being used.
stub-set command Set the stub of a PHAR file. If no input file is specified as stub then stdin is being used.
tree command Get a directory tree for a PHAR archive.
version command Get information about the PHAR environment and the tool version.
Algorithms:
0              No compression
none           No compression
auto           Automatically select compression algorithm
gz             GZip compression
gzip           GZip compression
bz2            BZip2 compression
bzip2          BZip2 compression
md5            MD5
sha1           SHA1
sha256         SHA256
sha512         SHA512
openssl        OpenSSL
For a more or less complete description of PHAR look here: http://php.net/phar
You can view the list of known bugs or report any new bug you found at: http://bugs.php.net
The PHP Group: Thies C. Arntzen, Stig Bakken, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski.
Work for the PHP archive was done by Gregory Beaver, Marcus Boerger.
A List of active developers can be found here: http://www.php.net/credits.php
And last but not least PHP was developed with the help of a huge amount of contributors all around the world.
This manpage describes phar, version 8.0.13.
Copyright Â© The PHP Group
This source file is subject to version 3.01 of the PHP license, that is bundled with this package in the file LICENSE, and is available through the world-wide-web at the following url: http://www.php.net/license/3_01.txt
If you did not receive a copy of the PHP license and are unable to obtain it through the world-wide-web, please send a note to license@php.net so we can mail you a copy immediately.
DEXDUMP(1)                        User Commands                       DEXDUMP(1)
dexdump - Dex Tool
debian/out/dexdump: error while loading shared libraries: libsigchain.so.0: cannot open shared object file: No such file or directory
tomb(1)                      General Commands Manual                     tomb(1)
Tomb - the Crypto Undertaker
tomb [options] command [arguments]
Tomb is an application to manage the creation and access of encrypted storage files: it can be operated from commandline and it can integrate with a user's graphical desktop.
Tomb generates encrypted storage files to be opened and closed using their associated keys, which are also protected with a password chosen by the user. To create, open and close tombs a user will need super user rights to execute the tomb commandline utility.
A tomb is like a locked folder that can be safely transported and hidden in a filesystem; it encourages users to keep their keys separate from tombs, for instance keeping a tomb file on your computer harddisk and its key file on a USB stick.
dig    Generates a file that can be used as a tomb and will occupy as much space as its desired initial size, the unlocked .tomb file can then be locked using a key. It takes a mandatory -s option which is the size in megabytes (MiB). Tombs are digged using random data gathered from a non-blocking source (/dev/urandom).
forge  Creates a new key and prompts the user for a password to protect its usage using symmetric encryption. This operation uses random data from a non-blocking source (/dev/urandom) and it may take long only in some cases; to switch using a blocking source the --use-random flag can be used. The -g option switches on the use of a GPG key instead of a password (asymmetric encryption), then the -r option indicates the recipient key; more recipient GPG ids can be indicated (comma separated). The default cipher to protect the key is AES256, a custom one can be specified using the -o option, for a list of supported ciphers use -v. For additional protection against dictionary attacks on keys, the --kdf option can be used when forging a key.
lock   Initializes and locks an empty tomb (made with dig) using a key (made with forge), making it ready for usage. After this operation, the tomb can only be opened in possession of the key and knowing its password. As in any other command requiring a key, the option -k should be used to specify a key file; in case of encryption to GPG recipients the -g flag should be used followed by -r and the recipient's secret GPG key id.  The -o option can be used to specify the cipher specification: default is "aes-xts- plain64", old versions of Tomb used "aes-cbc-essiv:sha256".  If you are looking for something exotic, also try "serpent-xts- plain64". More options may be found in cryptsetup(8) and Linux documentation. The --filesystem option can be used to specify "btrfs" as an alternative filesystem used to format the tomb, in place of the default "ext4". This operation requires root privileges to loopback mount, format the tomb (using LUKS and Ext4), then set the key in its first LUKS slot.
open   Opens an existing tomb file (first argument) using a key (-k) which can also be hidden inside a jpeg image (see bury/exhume) or a long text file (seecloak/uncloak). If a second argument is given it will indicate the mountpoint where the tomb should be made accessible, else the tomb is mounted in a directory inside /media (if not available it uses /run/media/$USER).  The option -o can be used to pass mount(8) options (default: rw,noatime,nodev). The -g option is needed when using GPG encryption to recipients.
list   List all the tombs found open, including information about the time they were opened and the hooks that they mounted. If the first argument is present, then shows only the tomb named that way or returns an error if it's not found. If the option --get- mountpoint is used then print a simple list of currently open tomb mountpoint paths.
ps     List all the processes found running inside the tombs that are open, printing out their PIDs and owners. This is useful to have an overview of programs that are keeping the tombs busy and would eventually be killed by the slam command. The lsof(8) utility is used internally to enumerate processes running in one or all tombs.
index  Creates or updates the search indexes of all tombs currently open: enables use of the search command using simple word patterns on file names. Indexes are created using mlocate's updatedb(8) and swish-e(1) if they are found on the system. Indexes allow one to search very fast for filenames and contents inside a tomb, they are stored inside it and are not accessible if the Tomb is closed. To avoid indexing a specific tomb simply touch a .noindex file in it.
search Takes any string as argument and searches for them through all tombs currently open and previously indexed using the index command.  The search matches filenames if mlocate is installed and then also file contents if swish++ is present on the system, results are listed on the console.
close  Closes a currently open tomb.  If more tombs are open, the first argument should be used to specify the name of the tomb to be closed, or all to close all currently open tombs. This command fails if the tomb is in use by running processes (to force close, see slam below).
slam   Closes a tomb like the command close does, but it doesn't fail even if the tomb is in use by other application processes: it looks for and closes each of them (in order: TERM, HUP, KILL). This command may provoke unsaved data loss, but assists users to face surprise situations. It requires lsof else it falls back to close.
passwd Changes the password protecting a key file specified using -k. With keys encrypted for GPG recipients use -g followed by -r to indicate the new recipient key, or a comma separated list.. The user will need to know the key's current password, or possess at least one of the current recipients GPG secret keys, because the key contents will be decoded and reencoded using the new passwords or keys. If the key file is broken (missing headers) this function also attempts its recovery.
setkey Changes the key file that locks a tomb, substituting the old one with a new one. Both the old and the new key files are needed for this operation and their passwords or GPG recipient(s) secret keys must be available. The new key must be specified using the -k option, the first argument should be the old key and the second and last argument the tomb file. Use the -g option to unlock the tomb with a GPG key, the -r to indicate the recipient or a comma separated list for more than one recipient.
resize Increase the size of a tomb file to the amount specified by the -s option, which is the new size in megabytes (MiB). Full access to the tomb using a key (-k) and its password is required. Tombs can only grow and can never be made smaller. This command makes use of the cryptsetup(8) resize feature and the resize2fs command: its much more practical than creating a new tomb and moving everything into it. There is no data-loss if a failure occurs during resize: the command can be re-launched and the resize operation will complete.
engrave This command transforms a tomb key into an image that can be printed on paper and physically stored as backup, i.e. hidden in a book. It Renders a QRCode of the tomb key, still protected by its password: a PNG image (extension .qr.png) will be created in the current directory and can be later printed (fits an A4 or Letter format).  To recover an engraved key one can use any QRCode reader on a smartphone: save it into a file and then use that file as a key (-k).
bury   Hides a tomb key (-k) inside a jpeg image (first argument) using steganography: the image will change in a way that cannot be noticed by human eye and hardly detected by data analysis. This option is useful to backup tomb keys in unsuspected places; it depends from the availability of steghide. Use the -g flag and -r option followed by recipient id to use GPG asymmetric encryption.
exhume This command recovers from jpeg images the keys that were previously hidden into them using bury.  Exhume requires a key filename (-k) and a jpeg image file (first argument) known to be containing a key. If the right key password is given, the key will be exhumed. If the password is not known, it is very hard to verify if a key is buried in any image or not.
cloak  Hides a tomb key (-k) inside a long plain-text file (first argument) using steganography: the text will change in a way that can hardly be noticed by human eye and hardly detected by data analysis. This option is useful to backup tomb keys in unsuspected places; it depends from the availability of cloakify and consequently python2. This function does not support asymmetric encryption using the -g flag.
uncloak This command recovers from long plain-text files the keys that were previously hidden into them using cloak.  Cloak requires a key filename (-k) and a plain-text file (first argument) known to be containing a key. If the right key password is given, the key will be exhumed. If the password is not known, it is quite hard to verify if a key is buried in a text or not.
-k <keyfile> For all operations requiring a key, this option specifies the location of the key file to use. Arguments can also be jpeg image files where keys have been hidden using the bury or cloak commands, or text files retrieved from engraved QR codes. If the keyfile argument is "-" (dash), Tomb will read the key from stdin (blocking).
-n     Skip processing of exec-hooks and bind-hooks if found inside the tomb.  See the HOOKS section in this manual for more information.
-p     When opening a tomb, preserves the ownership of all files and directories contained in it. Normally the open command changes the ownership of a tomb's contents to the UID and GID of the user who has successfully opened it: it is a usability feature in case a tomb is used by a single user across different systems. This flag deactivates this behaviour.
-o     Manually specify mount options to be used when opening a tomb instead of the default rw,noatime,nodev, i.e. to mount a tomb read-only (ro) to prevent any modification of its data. Can also be used to change the symmetric encryption algorithm for keys during forge operations (default AES256) or the LUKS encryption method during lock operations (default aes-xts-plain64).
-f     Force flag, currently used to override swap checks, might be overriding more wimpy behaviours in future, but make sure you know what you are doing if you force an operation.
-s <MBytes> When digging or resizing a tomb, this option must be used to specify the size of the new file to be created. Units are megabytes (MiB).
-g     Tell tomb to use a asymmetric GnuPG key encryption instead of a symmetric passphrase to protect a tomb key. This option can be followed by -r when the command needs to specify recipient(s).
-r <gpg_id>[,<gpg_id2>] Provide a new set of recipient(s) to encrypt a tomb key. gpg_ids can be one or more GPG key ID, comma separated. All GPG keys must be trusted keys in GPG.
--kdf <itertime> Activate the KDF feature against dictionary attacks when creating a key: forces a delay of <itertime> times every time this key is used.  The actual time to wait depends on the CPU speed of the computer where the key is used.  Using 5 or 10 is a sane amount for modern computers, the value is multiplied by 1 million.
--sphx-user <username> Activate the SPHINX feature for password-authenticated key agreement.  This option indicates the <username> used to retrieve the password from a sphinx oracle key reachable via TCP/IP.
--sphx-host <domain> Activate the SPHINX feature for password-authenticated key agreement.  This option indicates the <domain> used to retrieve the password from a sphinx oracle daemon reachable via TCP/IP. This is not the network address of the daemon, which is configured in /etc/sphinx
-h     Display a help text and quit.
-v     Display version and quit.
-q     Run more quietly
-D     Print more information while running, for debugging purposes
--no-color Suppress colors in console output (needed for string parsing by wrappers).
--unsafe Enable using dev-mode arguments, i.e. to pass passwords from commandline options. This is mostly used needed for execution by wrappers and testing suite.
--use-random Use a blocking random source. Tomb uses by default /dev/urandom since the non-blocking source of Linux kernel doesn't degrades the quality of random.
--tomb-pwd <string> Use string as password when needed on tomb.
--tomb-old-pwd <string> Use string as old password when needed in tomb commands requiring multiple keys, like passwd or setkey.
-U     Switch to this user ID when dropping privileges.
-G     Switch to this group ID when dropping privileges.
-T     Switch to this TTY terminal when dropping privileges.
Hooks are special files that can be placed inside the tomb and trigger actions when it is opened and closed; there are two kinds of such files: bind-hooks and exec-hooks can be placed in the base root of the tomb.
bind-hooks This hook file consists of a simple text file named bind-hooks containing a two column list of paths to files or directories inside the tomb. The files and directories will be be made directly accessible by the tomb open command inside the current user's home directory. Tomb uses internally the "mount -o bind" command to bind locations inside the tomb to locations found in $HOME. In the first column are indicated paths relative to the tomb and in the second column are indicated paths relative to $HOME contents, for example: mail          mail .gnupg        .gnupg .fmrc         .fetchmailrc .mozilla      .mozilla
exec-hooks This hook file gets executed as user by tomb with the first argument determining the step of execution (open or close) and the second being the full path to the mountpoint. The exec-hooks file should be executable (ELF or shell script) and present inside the Tomb. Tomb executes this hook as user and adds the name, loopback device and dev-mapper device paths as additional arguments for the close command.
The tomb commandline tool needs to acquire super user rights to execute most of its operations: to do so it uses sudo(8), while pinentry(1) is adopted to collect passwords from the user. Tomb executes as super user only when required.
To be made available on multi user systems, the superuser execution of the tomb script can be authorized for users without jeopardizing the whole system's security: just add such a line to /etc/sudoers:
username ALL=NOPASSWD: /usr/local/bin/tomb
To avoid that tomb execution is logged by syslog also add:
Cmnd_Alias TOMB = /usr/local/bin/tomb Defaults!TOMB !syslog
Password input is handled by the pinentry program: it can be text based or graphical and is usually configured with a symlink. When using Tomb in X11 it is better to use a graphical pinentry-gtk2 or pinentry-qt because it helps preventing keylogging by other X clients. When using it from a remote ssh connection it might be necessary to force use of pinentry- curses for instance by unsetting the DISPLAY environment var.
Tomb uses the external program "pinentry" to let users type the key password into a terminal or a graphical window. This program works in conjunction with "gpg-agent", a daemon running in background to facilitate secret key management with gpg. It is recommended one runs "gpg-agent" launching it from the X session initialization ("~/.xsession" or "~/.xinitrc" files) with this command:
eval $(gpg-agent --daemon --write-env-file "${HOME}/.gpg-agent-info")
In the future it may become mandatory to run gpg-agent when using tomb.
On execution of certain commands Tomb will complain about swap memory on disk when present and abort if your system has swap activated. You can disable this behaviour using the --force. Before doing that, however, you may be interested in knowing the risks of doing so:
•      During such operations a lack of available memory could cause the swap to write your secret key on the disk.
•      Even while using an opened tomb, another application could occupy too much memory so that the swap needs to be used, this way it is possible that some contents of files contained into the tomb are physically written on your disk, not encrypted.
If you don't need swap, execute  swapoff -a. If you really need it, you could make an encrypted swap partition. Tomb doesn't detect if your swap is encrypted, and will complain anyway.
The possibility to have an encrypted volume which is invisible and cannot be detected is called "deniability". The cryptographic layer of the device mapper in Linux (dm-crypt) does not implement deniability. Tomb is just a wrapper on top of that and it doesn't add cryptographic deniability. However a certain way of using tomb can facilitate a weak sort of deniability outside of the scenario of seized devices and forensic analysis of files and blocks on disc.
For instance to eliminate any trace of tomb usage from the shell history ZSh users can activate the "HISTIGNORESPACE" feature and prefix all invocations of tomb with a blank space, including two lines in ".zshrc":
export HISTIGNORESPACE=1 alias tomb=' tomb'
A tomb key can be encrypted with more than one recipient. Therefore, a tomb can be shared between different users. The recipients are given using the -r (or/and -R) option and if multiple each GPG key ID must be separated by a comma (,). Sharing a tomb is a very sensitive action and the user needs to trust that all the GPG public keys used are kept safe. If one of them its stolen or lost, it will be always possible to use it to access the tomb key unless all its copies are destroyed. The -r option can be used in the tomb commands: open, forge setkey, passwd, bury, exhume and resize.
SPHINX (PAKE) Using the package libsphinx ⟨https://github.com/stef/libsphinx⟩ and its python client/daemon implementation pwdsphinx ⟨https://github.com/stef/pwdsphinx⟩ is possible to store and retrieve safely the password that locks the tomb. Using this feature will make it impossible to retrieve the password without the oracle sphinx server running and reachable. Each key entry needs a username and a domain specified on creation and a password that locks it.
SPHINX makes it impossible to maliciously retrieve the password locking the tomb key without an attacker accessing both the server, the sphinx password and the tomb key file.
•      Create a 128MB large "secret" tomb and its keys, then open it:
tomb dig -s 128 secret.tomb
tomb forge secret.tomb.key
tomb lock secret.tomb -k secret.tomb.key
tomb open secret.tomb -k secret.tomb.key
•      Open a Tomb using the key from a remote SSH shell, without saving any local copy of it:
ssh user@my.shell.net 'cat .secrets/tomb.key' | tomb open secret.tomb -k -
•      Open a Tomb on a remote server passing the unencrypted local key on stdin via SSH, without saving any remote copy of it:
gpg -d .secrets/tomb.key | ssh server tomb open secret.tomb -k cleartext --unsafe
•      Create a bind hook that places your GnuPG folder inside the tomb, but makes it reachable from the standard $HOME/.gnupg location every time the tomb will be opened:
tomb open GPG.tomb -k GPG.tomb.key echo ".gnupg .gnupg" > /media/GPG.tomb/bind-hooks mv ~/.gnupg /media/GPG.tomb/.gnupg && mkdir ~/.gnupg tomb close GPG && tomb open GPG.tomb -k GPG.tomb.key
•      Script a tomb to launch the Firefox browser every time is opened, keeping all its profile data inside it:
tomb open FOX.tomb -k FOX.tomb.key cat <<EOF > /media/FOX.tomb/exec-hooks #!/bin/sh if [ "$1" = "open" ]; then firefox -no-remote -profile "$2"/firefox-pro & fi EOF chmod +x     /media/FOX.tomb/exec-hooks mkdir /media/FOX.tomb/firefox-pro
•      Script a tomb to archive Pictures using Shotwell, launching it on open:
tomb open Pictures.tomb -k Pictures.tomb.key cat <<EOF > /media/Pictures.tomb/bind-hooks Pictures Pictures EOF cat <<EOF > /media/Pictures.tomb/exec-hooks #!/bin/sh if [ "$1" = "open" ]; then which shotwell > /dev/null if [ "$?" = "0" ]; then shotwell -d "$2"/Pictures/.shotwell & fi fi EOF chmod +x /media/Pictures.tomb/exec-hooks
Please report bugs on the Github issue tracker at ⟨https://github.com/dyne/Tomb/issues⟩
One can also try to get in touch with developers via the #dyne chat channel on https://irc.dyne.org.
This manual is Copyright (c) 2011-2021 by Denis Roio <jaromil@dyne.org>
This manual includes contributions by Boyska and Hellekin O. Wolf.
Permission is  granted to copy,  distribute and/or modify  this manual under the terms of the  GNU Free Documentation License, Version 1.1 or any  later   version  published  by  the   Free  Software  Foundation. Permission is granted  to make and distribute verbatim  copies of this manual page  provided the above  copyright notice and  this permission notice are preserved on all copies.
The most recent version of Tomb sourcecode and up to date documentation is available for download from its website on https://tomb.dyne.org.
cryptsetup(8)
pinentry(1)
gpg-agent(1)
GnuPG website: https://www.gnupg.org
DM-Crypt website: https://gitlab.com/cryptsetup/cryptsetup/wikis/DMCrypt
LUKS website: https://gitlab.com/cryptsetup/cryptsetup/wikis/home
shc(1)                                                                    shc(1)
shc [ -e date ] [ -m addr ] [ -i iopt ] [ -x cmnd ] [ -l lopt ] [ -o outfile ] [ -ABCDhUHvSr ] -f script
shc creates a stripped binary executable version of the script specified with -f on the command line.
The binary version will get a .x extension appended by default if outfile is not defined with [-o outfile] option and will usually be a bit larger in size than the original ascii code.  Generated C source code is saved in a file with the extension .x.c or in a file specified with appropriate option.
If you supply an expiration date with the -e option, the compiled binary will refuse to run after the date specified.  The message Please contact your provider will be displayed instead.  This message can be changed with the -m option.
You can compile any kind of shell script, but you need to supply valid -i, -x and -l options.
The compiled binary will still be dependent on the shell specified in the first line of the shell code (i.e.  #!/bin/sh), thus shc does not create completely independent binaries.
shc itself is not a compiler such as cc, it rather encodes and encrypts a shell script and generates C source code with the added expiration capability.  It then uses the system compiler to compile a stripped binary which behaves exactly like the original script.  Upon execution, the compiled binary will decrypt and execute the code with the shell -c option.  Unfortunately, it will not give you any speed improvement as a real C program would.
shc's main purpose is to protect your shell scripts from modification or inspection.  You can use it if you wish to distribute your scripts but don't want them to be easily readable by other people.
-e date : Expiration date in dd/mm/yyyy format [none]
-m message : message to display upon expiration ["Please contact your provider"]
-f script_name : File path of the script to compile
-i inline_option : Inline option for the shell interpreter i.e: -e
-x command : eXec command, as a printf format i.e: exec(\\'%s\\',@ARGV);
-l last_option : Last shell option i.e: --
-o outfile : output to the file specified by outfile
-r : Relax security.  Make a redistributable binary which executes on different systems running the same operating system.  You can release your binary with this option for others to use
-v : Verbose compilation
-S : Switch ON setuid for root callable programs [OFF]
-D : Switch on debug exec calls
-U : Make binary to be untraceable (using strace, ptrace, truss, etc.)
-H : Hardening.  Extra security flag without root access requirement that protects against dumping, code injection, cat /proc/pid/cmdline, ptrace, etc..  This feature is experimental and may not work on all systems.  it require bourne shell (sh) scripts any positional parameters.
-C : Display license and exit
-A : Display abstract and exit
-B : Compile for BusyBox
-h : Display help and exit
CC : C compiler command [cc]
CFLAGS : C compiler flags [none]
LDFLAGS : Linker flags [none]
Compile a script which can be run on other systems with the trace option enabled (without -U flag):
shc -f myscript -o mybinary
Compile an untraceable binary:
shc -Uf myscript -o mybinary
Compile an untraceable binary that doesn't require root access (experimental):
shc -Hf myscript -o mybinary
The maximum size of the script that could be executed once compiled is limited by the operating system configuration parameter _SC_ARG_MAX (see sysconf(2))
Francisco Rosales <frosal@fi.upm.es>
intika <intika@librefox.org>
Md Jahidul Hamid <jahidulhamid@yahoo.com>
<https://github.com/neurobin/shc/issues>
Gource(1)                    General Commands Manual                   Gource(1)
Gource - a software version control visualization
gource [options] [path]
gource is an OpenGL-based 3D visualisation tool for source control repositories.
The repository is displayed as a tree where the root of the repository is the centre, directories are branches and files are leaves. Contributors to the source code appear and disappear as they contribute to specific files and directories.
gource requires a OpenGL capable video card to run.
-h, --help Help ('-H' for extended help).
-WIDTHxHEIGHT, --viewport WIDTHxHEIGHT Set the viewport size. If -f is also supplied, will attempt to set the video mode to this also. Add ! to make the window non- resizable.
-f      Fullscreen.
--screen SCREEN Set the number of the screen to display on.
--window-position XxY Initial window position on your desktop which may be made up of multiple monitors.
This will override the screen setting so don't specify both.
--frameless Frameless window.
--transparent Make the background transparent. Only really useful for screenshots.
--start-date "YYYY-MM-DD hh:mm:ss +tz" Start with the first entry after the supplied date and optional time.
If a time zone offset isn't specified the local time zone is used.
Example accepted formats:
"2012-06-30" "2012-06-30 12:00" "2012-06-30 12:00:00 +12"
--stop-date "YYYY-MM-DD hh:mm:ss +tz" Stop at the last entry prior to the supplied date and optional time.
Uses the same format as --start-date.
-p, --start-position POSITION Begin at some position in the log (between 0.0 and 1.0 or 'random').
--stop-position  POSITION Stop (exit) at some position in the log (does not work with STDIN).
-t, --stop-at-time SECONDS Stop (exit) after a specified number of seconds.
--stop-at-end Stop (exit) at the end of the log / stream.
--loop  Loop back to the start of the log when the end is reached.
--loop-delay-seconds SECONDS Seconds to delay before looping.
-a, --auto-skip-seconds SECONDS Automatically skip to next entry if nothing happens for a specified number of seconds.
-s, --seconds-per-day SECONDS Speed of simulation in seconds per day.
--realtime Realtime playback speed.
--no-time-travel Use the time of the last commit if the time of a commit is in the past.
-c, --time-scale SCALE Change simulation time scale.
-i, --file-idle-time SECONDS Time in seconds files remain idle before they are removed or 0 for no limit.
-e, --elasticity FLOAT Elasticity of nodes.
-b, --background-colour FFFFFF Background colour in hex.
--background-image IMAGE Set a background image.
--title TITLE Set a title
--font-file FILE Specify the font. Should work with most font file formats supported by FreeType, such as TTF and OTF, among others.
--font-scale SCALE Scale the size of all fonts.
--font-size SIZE Font size used by the date and title.
--file-font-size SIZE Font size of filenames.
--dir-font-size SIZE Font size of directory names.
--user-font-size SIZE Font size of user names.
--font-colour FFFFFF Font colour used by the date and title in hex.
--key   Show file extension key.
--logo IMAGE Logo to display in the foreground.
--logo-offset XxY Offset position of the logo.
--date-format FORMAT Specify display date string (strftime format).
--log-command VCS Show the log command used by gource (git,svn,hg,bzr,cvs2cl).
--log-format VCS Specify format of the log being read (git,svn,hg,bzr,cvs2cl,custom). Required when reading from STDIN.
--git-branch Get the git log of a branch other than the current one.
--follow-user USER Have the camera automatically follow a particular user.
--highlight-dirs Highlight the names of all directories.
--highlight-user USER Highlight the names of a particular user.
--highlight-users Highlight the names of all users.
--highlight-colour FFFFFF Font colour for highlighted users in hex.
--selection-colour FFFFFF Font colour for selected users and files.
--filename-colour FFFFFF Font colour for filenames.
--dir-colour FFFFFF Font colour for directories.
--dir-name-depth DEPTH Draw names of directories down to a specific depth in the tree.
--dir-name-position FLOAT Position along edge of the directory name (between 0.1 and 1.0, default is 0.5).
--filename-time SECONDS Duration to keep filenames on screen (>= 2.0).
--file-extensions Show filename extensions only.
--file-extension-fallback Use filename as extension if the extension is missing or empty.
--file-filter REGEX Filter out file paths matching the specified regular expression.
--file-show-filter REGEX Show only file paths matching the specified regular expression.
--user-filter REGEX Filter usernames matching the specified regular expression.
--user-show-filter REGEX Show only usernames matching the specified regular expression.
--user-image-dir DIRECTORY Directory containing .jpg or .png images of users (eg "Full Name.png") to use as avatars.
--default-user-image IMAGE Path of .jpg to use as the default user image.
--colour-images Colourize user images.
--crop AXIS Crop view on an axis (vertical,horizontal).
--padding FLOAT Camera view padding.
--multi-sampling Enable multi-sampling.
--no-vsync Disable vsync.
--bloom-multiplier FLOAT Adjust the amount of bloom.
--bloom-intensity FLOAT Adjust the intensity of the bloom.
--max-files NUMBER Set the maximum number of files or 0 for no limit. Excess files will be discarded.
--max-file-lag SECONDS Max time files of a commit can take to appear. Use -1 for no limit.
--max-user-speed UNITS Max speed users can travel per second.
--user-friction SECONDS Time users take to come to a halt.
--user-scale SCALE Change scale of user avatars.
--camera-mode MODE Camera mode (overview,track).
--disable-auto-rotate Disable automatic camera rotation.
--disable-input Disable keyboard and mouse input.
--hide DISPLAY_ELEMENT Hide one or more display elements from the list below: