   This file documents the GNU networking utilities.

   Copyright (C) 1994, 95, 96, 2000, 2001 Free Software Foundation, Inc.

   Permission is granted to make and distribute verbatim copies of this
manual provided the copyright notice and this permission notice are
preserved on all copies.

   Permission is granted to copy and distribute modified versions of
this manual under the conditions for verbatim copying, provided that
the entire resulting derived work is distributed under the terms of a
permission notice identical to this one.

   Permission is granted to copy and distribute translations of this
manual into another language, under the above conditions for modified
versions, except that this permission notice may be stated in a
translation approved by the Foundation.

GNU networking utilities
************************

This manual documents version 1.4.2 of the GNU network utilities.

1 Introduction
**************

The individual utilities was originally derived from the 4.4BSDLite2
distribution.  Many features were integrated from NetBSD, OpenBSD,
FreeBSD and GNU/Linux, the merges were done by a group of dedicated
hackers (in no particular order): Jeff Bailey, Marcus Brinkmann,
Michael Vogt, Bernhard Rosenkraenzer, Kaveh R. Ghazi, NIIBE Yutaka,
Nathan Neulinger, Jeff Smith, Dan Stromberg, David O'Shea, Frederic
Goudal, Gerald Combs, Joachim Gabler, Marco D'Itri.

   Certain options are available in all these programs.  Rather than
writing identical descriptions for each of the programs, they are
described here.  (In fact, every GNU program accepts (or should accept)
these options.)

   Many of these programs take arbitrary strings as arguments.  In those
cases, `--help' and `--version' are taken as these options only if
there is one and exactly one command line argument.

`--help'
     Print a usage message listing all available options, then exit
     successfully.

`-V'
`--version'
     Print the version number, then exit successfully.

2 ftp
*****

`Ftp' is the user interface to the ARPANET standard File Transfer
Protocol.  The program allows a user to transfer files to and from a
remote network site.

2.1 Invoking
============

The options are as follows:

`-d'
`--debug'
     Enables debugging.

`-g'
`--no-glob'
     Disables file name globbing.

`-i'
`--no-prompt'
     Turns off interactive prompting during multiple file transfers.

`-n'
`--no-login'
     Restrains ftp from attempting "auto-login" upon initial connection.
     If auto-login is enabled, ftp will check the .netrc (see below)
     file in the user's home directory for an entry describing an
     account on the remote machine.  If no entry exists, ftp will
     prompt for the remote machine login name (default is the user
     identity on the local machine), and, if necessary, prompt for a
     password and an account with which to login.

`-t'

`--trace'
     Enable packet tracing.

`-p PROMPT'
`--prompt=PROMPT'
     Print a command-line prompt (optionally PROMPT), even if not on a
     tty.

`-v'
`--verbose'
     Be verbose.

2.2 Commands
============

The client host with which ftp is to communicate may be specified on the
command line.  If this is done, ftp will immediately attempt to
establish a connection to an FTP server on that host; otherwise, ftp
will enter its command interpreter and await instructions from the
user.  When ftp is awaiting commands from the user the prompt `ftp>' is
provided to the user.  The following commands are recognized by ftp:

`! [command [args]]'
     Invoke an interactive shell on the local machine.  If there are
     arguments, the first is taken to be a command to execute directly,
     with the rest of the arguments as its arguments.

`$ macro-name [args]'
     Execute the macro macro-name that was defined with the macdef
     command.  Arguments are passed to the macro unglobbed.

`account [passwd]'
     Supply a supplemental password required by a remote system for
     access to resources once a login has been successfully completed.
     If no argument is included, the user will be prompted for an
     account password in a non-echoing input mode.

`append local-file [remote-file]'
     Append a local file to a file on the remote machine.  If
     remote-file is left unspecified, the local file name is used in
     naming the remote file after being altered by any ntrans or nmap
     setting.  File transfer uses the current settings for type,
     format, mode, and structure.

`ascii'
     Set the file transfer type to network ASCII. This is the default
     type.

`bell'
     Arrange that a bell be sounded after each file transfer command is
     completed.

`binary'
     Set the file transfer type to support binary image transfer.

`bye'
     Terminate the FTP session with the remote server and exit ftp. An
     end of file will also terminate the session and exit.

`case'
     Toggle remote computer file name case mapping during mget
     commands.  When case is on (default is off), remote computer file
     names with all letters in upper case are written in the local
     directory with the letters mapped to lower case.

`cd remote-directory'
     Change the working directory on the remote machine to
     remote-directory.

`cdup'
     Change the remote machine working directory to the parent of the
     current remote machine working directory.

`chmod mode file-name'
     Change the permission modes of the file file-name on the re- mote
     sytem to mode.

`close'
     Terminate the FTP session with the remote server, and return to
     the command interpreter.  Any defined macros are erased.

`cr'
     Toggle carriage return stripping during ascii type file retrieval.
     Records are denoted by a carriage return/linefeed sequence during
     ascii type file transfer.  When cr is on (the default), carriage
     returns are stripped from this sequence to conform with the UNIX
     single linefeed record delimiter.  Records on non-UNIX remote
     systems may contain single linefeeds; when an ascii type transfer
     is made, these linefeeds may be distinguished from a record
     delimiter only when cr is off.

`delete remote-file'
     Delete the file remote-file on the remote machine.

`debug [debug-value]'
     Toggle debugging mode.  If an optional debug-value is specified it
     is used to set the debugging level.  When debugging is on, ftp
     prints each command sent to the remote machine, preceded by the
     string `->'

`dir [remote-directory] [local-file]'
     Print a listing of the directory contents in the directory,
     remote-directory, and, optionally, placing the output in
     local-file. If interactive prompting is on, ftp will prompt the
     user to verify that the last argument is indeed the tar- get local
     file for receiving dir output.  If no directory is specified, the
     current working directory on the remote ma- chine is used.  If no
     local file is specified, or local-file is -, output comes to the
     terminal.

`disconnect'
     A synonym for close.

`form format'
     Set the file transfer form to format. The default format is "file".

`get remote-file [local-file]'
     Retrieve the remote-file and store it on the local machine.  If
     the local file name is not specified, it is given the same name it
     has on the remote machine, subject to alteration by the current
     case, ntrans, and nmap settings.  The current settings for type,
     form, mode, and structure are used while transferring the file.

`glob'
     Toggle filename expansion for mdelete, mget and mput. If globbing
     is turned off with glob, the file name arguments are taken
     literally and not expanded.  Globbing for mput is done as in
     csh(1).  For mdelete and mget, each remote file name is expanded
     separately on the remote machine and the lists are not merged.
     Expansion of a directory name is likely to be different from
     expansion of the name of an ordinary file: the exact result
     depends on the foreign operating system and ftp server, and can be
     previewed by doing `mls remote-files -' Note: mget and mput are
     not meant to transfer entire directo- ry subtrees of files.  That
     can be done by transferring a tar(1) archive of the subtree (in
     binary mode).

`hash [size]'
     Toggle hash-sign ("#") printing for each data block transferred.
     The size of a data block can optionally be specified.  If not
     given, it defaults to 1024 bytes.

`help [command]'
     Print an informative message about the meaning of command. If no
     argument is given, ftp prints a list of the known commands.

`idle [seconds]'
     Set the inactivity timer on the remote server to seconds seconds.
     If seconds is omitted, the current inactivity timer is printed.

`lcd [directory]'
     Change the working directory on the local machine.  If no
     directory is specified, the user's home directory is used.

`ls [remote-directory] [local-file]'
     Print a listing of the contents of a directory on the remote
     machine.  The listing includes any system-dependent information
     that the server chooses to include; for example, most UNIX systems
     will produce output from the command `ls -l'.  (See also nlist.)
     If remote-directory is left unspecified, the current working
     directory is used.  If interactive prompting is on, ftp will
     prompt the user to verify that the last argument is indeed the
     target local file for receiving ls output.  If no local file is
     specified, or if local-file is `-', the output is sent to the
     terminal.

`macdef macro-name'
     Define a macro.  Subsequent lines are stored as the macro
     macro-name; a null line (consecutive newline characters in a file
     or carriage returns from the terminal) terminates macro input
     mode.  There is a limit of 16 macros and 4096 total characters in
     all defined macros.  Macros remain defined until a close command
     is executed.  The macro processor interprets `$' and `\' as
     special characters.  A `$' followed by a number (or numbers) is
     replaced by the corresponding argument on the macro invocation
     command line.  A `$' followed by an `i' signals that macro
     processor that the executing macro is to be looped.  On the first
     pass `$i' is replaced by the first argument on the macro
     invocation command line, on the second pass it is replaced by the
     second argument, and so on.  A `\' followed by any character is
     replaced by that character.  Use the `\' to prevent special
     treatment of the `$'.

`mdelete [remote-files]'
     Delete the remote-files on the remote machine.

`mdir remote-files local-file'
     Like dir, except multiple remote files may be specified.  If
     interactive prompting is on, ftp will prompt the user to verify
     that the last argument is indeed the target local file for
     receiving mdir output.

`mget remote-files'
     Expand the remote-files on the remote machine and do a get for
     each file name thus produced.  See glob for details on the
     filename expansion.  Resulting file names will then be processed
     according to case, ntrans, and nmap settings.  Files are
     transferred into the local working directory, which can be changed
     with `lcd directory'; new local directories can be created with `!
     mkdir directory'.

`mkdir directory-name'
     Make a directory on the remote machine.

`mls remote-files local-file'
     Like nlist, except multiple remote files may be specified, and the
     local-file must be specified.  If interactive prompting is on, ftp
     will prompt the user to verify that the last argument is indeed
     the target local file for receiving mls output.

`mode [mode-name]'
     Set the file transfer mode to mode-name. The default mode is
     "stream" mode.

`modtime file-name'
     Show the last modification time of the file on the remote machine.

`mput local-files'
     Expand wild cards in the list of local files given as arguments
     and do a put for each file in the resulting list.  See glob for
     details of filename expansion.  Resulting file names will then be
     processed according to ntrans and nmap settings.

`newer file-name'
     Get the file only if the modification time of the remote file is
     more recent that the file on the current system.  If the file does
     not exist on the current system, the remote file is considered
     newer. Otherwise, this command is identical to get.

`nlist [remote-directory] [local-file]'
     Print a  list of the files in a directory on the remote machine.
     If remote-directory is left unspecified, the current working
     directory is used.  If interactive prompting is on, ftp will
     prompt the user to verify that the last argument is indeed the
     target local file for receiving nlist output.  If no local file is
     specified, or if local-file is -, the output is sent to the
     terminal.

`nmap [inpattern outpattern]'
     Set or unset the filename mapping mechanism.  If no arguments are
     specified, the filename mapping mechanism is unset.  If arguments
     are specified, remote filenames are mapped during mput commands
     and put commands issued without a specified remote target
     filename.  If arguments are specified, local filenames are mapped
     during mget commands and get commands issued without a specified
     local target filename.  This command is useful when connecting to
     a non-UNIX remote computer with different file naming conventions
     or practices.  The mapping follows the pattern set by inpattern
     and outpattern.  [Inpattern] is a template for incoming filenames
     (which may have already been processed according to the ntrans and
     case settings).  Variable templating is accomplished by including
     the sequences `$1', `$2', ..., `$9' in inpattern. Use `\' to
     prevent this special treatment of the `$' character.  All other
     characters are treated literally, and are used to de- termine the
     nmap [inpattern] variable values.  For example, given inpattern
     $1.$2 and the remote file name "mydata.data", $1 would have the
     value "mydata", and $2 would have the value data".  The outpattern
     determines the resulting mapped filename.  The sequences `$1',
     `$2', ...., `$9' are replaced by any value resulting from the
     inpattern template.  The sequence `$0' is replace by the original
     filename.  Additionally, the sequence `[seq1, seq2]' is replaced
     by [seq1] if seq1 is not a null string; otherwise it is replaced
     by seq2. For example, the command

            nmap $1.$2.$3 [$1,$2].[$2,file]

     would yield the output filename "myfile.data" for input filenames
     "myfile.data" and "myfile.data.old", "myfile.file" for the input
     filename "myfile", and "myfile.myfile" for the in- put filename
     ".myfile".  Spaces may be included in outpattern, as in the
     example: `nmap $1 sed "s/  *$//" > $1'.  Use the `\' character to
     prevent special treatment of the `$','[','[', and `,' characters.

`ntrans [inchars [outchars]]'
     Set or unset the filename character translation mechanism.  If no
     arguments are specified, the filename character translation
     mechanism is unset.  If arguments are specified, characters in
     remote filenames are translated during mput commands and put
     commands issued without a specified remote target filename.  If
     arguments are specified, characters in local filenames are
     translated during mget commands and get commands issued without a
     specified local target filename.  This command is useful when
     connecting to a non-UNIX remote computer with different file
     naming conventions or practices.  Characters in a filename
     matching a character in inchars are replaced with the
     corresponding character in outchars. If the character's position
     in inchars is longer than the length of outchars, the character is
     deleted from the file name.

`open host [port]'
     Establish a connection to the specified host FTP server.  An
     optional port number may be supplied, in which case, ftp will
     attempt to contact an FTP server at that port.  If the autologin
     option is on (default), ftp will also attempt to automatically log
     the user in to the FTP server (see below).

`passive'
     Toggle passive mode.  If passive mode is turned on (default is
     off), the ftp client will send a PASV command for all data
     connections instead of the usual PORT command.  The PASV com- mand
     requests that the remote server open a port for the data
     connection and return the address of that port.  The remote server
     listens on that port and the client connects to it.  When using
     the more traditional PORT command, the client listens on a port
     and sends that address to the remote server, who connects back to
     it.  Passive mode is useful when using ftp through a gateway
     router or host that controls the directionality of traffic.  (Note
     that though ftp servers are required to support the PASV command
     by RFC 1123, some do not.)

`prompt'
     Toggle interactive prompting.  Interactive prompting occurs during
     multiple file transfers to allow the user to selectively retrieve
     or store files.  If prompting is turned off (default is on), any
     mget or mput will transfer all files, and any mdelete will delete
     all files.

`proxy ftp-command'
     Execute an ftp command on a secondary control connection.  This
     command allows simultaneous connection to two remote ftp servers
     for transferring files between the two servers.  The first proxy
     command should be an open, to establish the secondary control
     connection.  Enter the command "proxy ?" to see other ftp commands
     executable on the secondary connection.  The following commands
     behave differently when prefaced by proxy: open will not define
     new macros during the auto-login process, close will not erase
     existing macro definitions, get and mget transfer files from the
     host on the primary control connection to the host on the
     secondary control connection, and put, mput, and append transfer
     files from the host on the secondary control connection to the
     host on the primary control connection.  Third party file
     transfers depend upon support of the ftp protocol PASV command by
     the server on the secondary control connection.

`put local-file [remote-file]'
     Store a local file on the remote machine.  If remote-file is left
     unspecified, the local file name is used after processing according
     to any ntrans or nmap settings in naming the remote file.  File
     transfer uses the current settings for type, format, mode, and
     structure.

`pwd'
     Print the name of the current working directory on the remote
     machine.

`quit'
     A synonym for bye.

`quote arg1 arg2 ...'
     The arguments specified are sent, verbatim, to the remote FTP
     server.

`recv remote-file [local-file]'
     A synonym for get.

`reget remote-file [local-file]'
     Reget acts like get, except that if local-file exists and is
     smaller than remote-file, local-file is presumed to be a partially
     transferred copy of remote-file and the transfer is continued from
     the apparent point of failure.  This command is useful when
     transferring very large files over networks that are prone to
     dropping connections.

`remotehelp [command-name]'
     Request help from the remote FTP server.  If a command-name is
     specified it is supplied to the server as well.

`remotestatus [file-name]'
     With no arguments, show status of remote machine.  If filename is
     specified, show status of file-name on remote machine.

`rename [from] [to]'
     Rename the file from on the remote machine, to the file to.

`reset'
     Clear reply queue.  This command re-synchronizes command/reply
     sequencing with the remote ftp server.  Resynchronization may be
     necessary following a violation of the ftp protocol by the remote
     server.

`restart marker'
     Restart the immediately following get or put at the indicated
     marker. On UNIX systems, marker is usually a byte offset into the
     file.

`rmdir directory-name'
     Delete a directory on the remote machine.

`runique'
     Toggle storing of files on the local system with unique filenames.
     If a file already exists with a name equal to the target local
     filename for a get or mget command, a ".1" is appended to the
     name.  If the resulting name matches another existing file, a ".2"
     is appended to the original name.  If this process continues up to
     ".99", an error message is printed, and the transfer does not take
     place.  The generated unique filename will be reported.  Note that
     runique will not affect local files generated from a shell command
     (see below).  The default value is off.

`send local-file [remote-file]'
     A synonym for put.

`sendport'
     Toggle the use of PORT commands.  By default, ftp will attempt to
     use a PORT command when establishing a connection for each data
     transfer.  The use of PORT commands can prevent delays when
     performing multiple file transfers.  If the PORT command fails,
     ftp will use the default data port.  When the use of PORT commands
     is disabled, no attempt will be made to use PORT commands for each
     data transfer.  This is useful for certain FTP implementations
     which do ignore PORT commands but, incorrectly, indicate they've
     been accepted.

`site arg1 arg2 ...'
     The arguments specified are sent, verbatim, to the remote FTP
     server as a SITE command.

`size file-name'
     Return size of file-name on remote machine.

`status'
     Show the current status of ftp.

`struct [struct-name]'
     Set the file transfer structure to struct-name. By default
     "stream" structure is used.

`sunique'
     Toggle storing of files on remote machine under unique file names.
     Remote ftp server must support ftp protocol STOU command for
     successful completion.  The remote server will report unique name.
     Default value is off.

`system'
     Show the type of operating system running on the remote machine.

`tenex'
     Set the file transfer type to that needed to talk to TENEX
     machines.

`trace'
     Toggle packet tracing.

`type [type-name]'
     Set the file transfer type to type-name. If no type is specified,
     the current type is printed.  The default type is net- work ASCII.

`umask [newmask]'
     Set the default umask on the remote server to newmask. If newmask
     is omitted, the current umask is printed.

`user user-name [password] [account]'
     Identify yourself to the remote FTP server.  If the password is
     not specified and the server requires it, ftp will prompt the user
     for it (after disabling local echo).  If an account field is not
     specified, and the FTP server requires it, the user will be
     prompted for it.  If an account field is specified, an account
     command will be relayed to the remote server after the login
     sequence is completed if the remote server did not require it for
     logging in.  Unless ftp is invoked with "auto-login" disabled,
     this process is done automatically on initial connection to the
     FTP server.

`verbose'
     Toggle verbose mode.  In verbose mode, all responses from the FTP
     server are displayed to the user.  In addition, if verbose is on,
     when a file transfer completes, statistics regarding the
     efficiency of the transfer are reported.  By default, verbose is
     on.

`? [command]'
     A synonym for help.

   Command arguments which have embedded spaces may be quoted with
quote `"' marks.

2.3 Aborting A File Transfer
============================

To abort a file transfer, use the terminal interrupt key (usually
Ctrl-C).  Sending transfers will be immediately halted.  Receiving
transfers will be halted by sending a ftp protocol ABOR command to the
remote server, and discarding any further data received.  The speed at
which this is accomplished depends upon the remote server's support for
ABOR processing.  If the remote server does not support the ABOR
command, an `ftp>' prompt will not appear until the remote server has
completed sending the requested file.

   The terminal interrupt key sequence will be ignored when ftp has
completed any local processing and is awaiting a reply from the remote
server.  A long delay in this mode may result from the ABOR processing
described above, or from unexpected behavior by the remote server,
including violations of the ftp protocol.  If the delay results from
unexpected remote server behavior, the local ftp program must be killed
by hand.

2.4 File Naming Conventions
===========================

Files specified as arguments to ftp commands are processed according to
the following rules.

  1. If the file name `-' is specified, the stdin (for reading) or
     stdout (for writing) is used.

  2. If the first character of the file name is `|', the remainder of
     the argument is interpreted as a shell command.  Ftp then forks a
     shell, using popen(3) with the argument supplied, and reads
     (writes) from the stdout (stdin).  If the shell command includes
     spaces, the argument must be quoted; e.g.  "" ls -lt"".  A
     particularly useful example of this mechanism is: "dir more".

  3. Failing the above checks, if "globbing" is enabled, local file
     names are expanded according to the rules used in the csh(1);  c.f.
     the glob command.  If the ftp command expects a single local file
     (.e.g.  put), only the first filename generated by the "globbing"
     operation is used.

  4. For mget commands and get commands with unspecified local file
     names, the local filename is the remote filename, which may be
     altered by a case, ntrans, or nmap setting.  The resulting filename
     may then be altered if runique is on.

  5. For mput commands and put commands with unspecified remote file
     names, the remote filename is the local filename, which may be
     altered by a ntrans or nmap setting.  The resulting filename may
     then be altered by the remote server if sunique is on.

2.5 File Transfer Parameters
============================

The FTP specification specifies many parameters which may affect a file
transfer.  The type may be one of "ascii", "image" (binary), "ebcdic",
and "local byte size" (for PDP-10's and PDP-20's mostly).  Ftp supports
the ascii and image types of file transfer, plus local byte size 8 for
tenex mode transfers.

   Ftp supports only the default values for the remaining file transfer
parameters: mode, form, and struct.

2.6 The `.netrc' File
=====================

The .netrc file contains login and initialization information used by
the auto-login process.  It resides in the user's home directory.  The
following tokens are recognized; they may be separated by spaces, tabs,
or new-lines:

`machine name'
     Identify a remote machine name. The auto-login process searches
     the .netrc file for a machine token that matches the remote ma-
     chine specified on the ftp command line or as an open command
     argument.  Once a match is made, the subsequent .netrc tokens are
     processed, stopping when the end of file is reached or an- other
     machine or a default token is encountered.

`default'
     This is the same as machine name except that default matches any
     name.  There can be only one default token, and it must be after
     all machine tokens.  This is normally used as:
                     default login anonymous password user@site

     thereby giving the user automatic anonymous ftp login to machines
     not specified in .netrc. This can be overridden by using the -n
     flag to disable auto-login.

`login name'
     Identify a user on the remote machine.  If this token is present,
     the auto-login process will initiate a login using the specified
     name.

`password string'
     Supply a password.  If this token is present, the auto-login
     process will supply the specified string if the remote server
     requires a password as part of the login process.  Note that if
     this token is present in the .netrc file for any user other than
     anonymous, ftp will abort the auto-login process if the `.netrc'
     is readable by anyone besides the user.

`account string'
     Supply an additional account password.  If this token is present,
     the auto-login process will supply the specified string if the
     remote server requires an additional account password, or the
     auto-login process will initiate an ACCT command if it does not.

`macdef name'
     Define a macro.  This token functions like the ftp macdef command
     functions.  A macro is defined with the specified name; its
     contents begin with the next .netrc line and continue until a null
     line (consecutive new-line characters) is encountered.  If a macro
     named init is defined, it is automatically executed as the last
     step in the auto-login process.

   Ftp utilizes the following environment variables.

`HOME'
     For default location of a .netrc file, if one exists.

`SHELL'
     For default shell.

   Correct execution of many commands depends upon proper behavior by
the remote server.

   An error in the treatment of carriage returns in the 4.2BSD
ascii-mode transfer code has been corrected.  This correction may
result in incorrect transfers of binary files to and from 4.2BSD
servers using the ascii type.  Avoid this problem by using the binary
image type.

3 ftpd
******

`Ftpd' is the Internet File Transfer Protocol server process.  The
server uses the TCP protocol and listens at the port specified in the
"ftp" service specification; see services(5).

3.1 Invoking
============

The options are as follows:

`-A'
`--anonymous-only'
     Only anonymous login is allowed.

`-a AUTH'

`--auth=AUTH'
     Give anonymous an other login-name (anonymous and ftpd will still
     work).

`-D'
`--daemon'
     `ftpd' enters daemon-mode. That allows ftpd to be run without
     inetd.

`-d'
`--debug'
     Debugging information is written to the syslog using LOG_FTP.

`-l'
`--logging'
     Each successful and failed ftp(1) session is logged using syslog
     with a facility of LOG_FTP.  If this option is specified twice,
     the retrieve (get), store (put), append, delete, make directory,
     remove directory and rename operations and their filename
     arguments are also logged.

`-p PIDFILE'

`--pidfile=PIDFILE'
     Change default location of PIDFILE

`-q'

`--no-version'
     Quiet mode. No information about the version of the ftpd is given
     to the client.

`-T'

`--max-timeout'
     A client may also request a different timeout period; the maximum
     period allowed may be set to timeout seconds with the -T option.
     The default limit is 2 hours.

`-t TIMEOUT'

`--timeout=TIMEOUT'
     The inactivity timeout period is set to timeout seconds (the
     default is 15 minutes).

`-u UMASK'

`--umask=UMASK'
     Set default umask(base 8).

   The file `/etc/nologin' can be used to disable ftp access.  If the
file exists, ftpd displays it and exits.  If the file `/etc/ftpwelcome'
exists, `ftpd' prints it before issuing the "ready" message.  If the
file `/etc/motd' exists, ftpd prints it after a successful login.

   The ftp server currently supports the following ftp requests.  The
case of the requests is ignored.

                Request    Description
                ABOR       abort previous command
                ACCT       specify account (ignored)
                ALLO       allocate storage (vacuously)
                APPE       append to a file
                CDUP       change to parent of current working directory
                CWD        change working directory
                DELE       delete a file
                HELP       give help information
                LIST       give list files in a directory (``ls -lgA'')
                MKD        make a directory
                MDTM       show last modification time of file
                MODE       specify data transfer mode
                NLST       give name list of files in directory
                NOOP       do nothing
                PASS       specify password
                PASV       prepare for server-to-server transfer
                PORT       specify data connection port
                PWD        print the current working directory
                QUIT       terminate session
                REST       restart incomplete transfer
                RETR       retrieve a file
                RMD        remove a directory
                RNFR       specify rename-from file name
                RNTO       specify rename-to file name
                SITE       non-standard commands (see next section)
                SIZE       return size of file
                STAT       return status of server
                STOR       store a file
                STOU       store a file with a unique name
                STRU       specify data transfer structure
                SYST       show operating system type of server system
                TYPE       specify data transfer type
                USER       specify user name
                XCUP       change to parent of current working directory
                           (deprecated)
                XCWD       change working directory (deprecated)
                XMKD       make a directory (deprecated)
                XPWD       print the current working directory (deprecated)
                XRMD       remove a directory (deprecated)

          The following non-standard or UNIX specific commands are supported by the
          SITE request.

                Request    Description
                UMASK      change umask, e.g. ``SITE UMASK 002''
                IDLE       set idle-timer, e.g. ``SITE IDLE 60''
                CHMOD      change mode of a file, e.g. ``SITE CHMOD0 0CHMOD1
                           1CHMOD2
                HELP       give help information.

   The remaining ftp requests specified in Internet RFC 959 are
recognized, but not implemented.  MDTM and SIZE are not specified in
RFC 959, but will appear in the next updated FTP RFC.

   The ftp server will abort an active file transfer only when the ABOR
com- mand is preceded by a Telnet "Interrupt Process" (IP) signal and a
Telnet Synch" signal in the command Telnet stream, as described in
Internet RFC 959.  If a STAT command is received during a data
transfer, preceded by a Telnet IP and Synch, transfer status will be
returned.

   Ftpd interprets file names according to the "globbing" conventions
used by csh(1).  This allows users to utilize the metacharacters
"*?[]{}~".

   Ftpd authenticates users according to three rules.

  1. The login name must be in the password data base, `/etc/passwd',
     and not have a null password.  In this case a password must be
     provided by the client before any file operations may be per-
     formed.

  2. The login name must not appear in the file `/etc/ftpusers'.

  3. The user must have a standard shell returned by getusershell(3).

  4. If the user name is "anonymous" or "ftp", an anonymous ftp account
     must be present in the password file (user "ftp").  In this case
     the user is allowed to log in by specifying any password (by
     convention an email address for the user should be used as the
     password).

   In the last case, ftpd takes special measures to restrict the
client's access privileges.  The server performs a chroot(2) to the
home directory of the "ftp" user.  In order that system security is not
breached, it is recommended that the "ftp" subtree be constructed with
care, following these rules:

`~ftp'
     Make the home directory owned by "root" and unwritable by anyone.

`~ftp/bin'
     Make this directory owned by "root" and unwritable by anyone (mode
     555).  The program ls(1) must be present to support the list
     command.  This program should be mode 111.

`~ftp/etc'
     Make this directory owned by "root" and unwritable by anyone (mode
     555).  The files passwd(5) and group(5) must be present for the ls
     command to be able to produce owner names rather than numbers.
     The password field in passwd is not used, and should not contain
     real passwords.  The file motd, if present, will be printed after
     a successful login.  These files should be mode 444.

`~ftp/pub'
     Make this directory mode 777 and owned by "ftp". Guests can then
     place files which are to be accessible via the anonymous account
     in this directory.

3.2 Configuration files
=======================

``/etc/ftpusers''
     List of unwelcome/restricted users.

``/etc/ftpwelcome''
     Welcome notice.

``/etc/motd''
     Welcome notice after login.

``/etc/nologin''
     Displayed and access refused.

4 inetd
*******

`Inetd' program should be run at boot time by /etc/rc (see rc(8)).  It
then listens for connections on certain internet sockets.  When a
connection is found on one of its sockets, it decides what service the
socket corresponds to, and invokes a program to service the request.
The server program is invoked with the service socket as its standard
input, output and error descriptors.  After the program is finished,
inetd continues to listen on the socket (except in some cases which
will be described below).  Essentially, inetd allows running one daemon
to invoke several others, reducing load on the system.

4.1 Invoking
============

The options are as follows:

`-d'
`--debug'
     Turns on debugging.

`-R RATE'
`--rate=RATE'
     Specifies the maximum number of times a service can be invoked in
     one minute; the default is 1000.

4.2 Configuration file
======================

Upon execution, inetd reads its configuration information from a
configuration pathnames on the command line, by default,
`/etc/inetd.conf' and `/etc/initd.d'.  If the configuration pathname is
a directory, all the files in the directory are read like a
configuration file. All of the configuration files are read and merged.
There must be an entry for each field in the configuration file, with
entries for each field separated by a tab or a space.  Comments are
denoted by a "#" at the beginning of a line.  There must be an entry
for each field.  The fields of the configuration file are as follows:

                service name
                socket type
                protocol
                wait/nowait
                user
                server program
                server program arguments

   There are two types of services that inetd can start: standard and
TCPMUX.  A standard service has a well-known port assigned to it; it
may be a service that implements an official Internet standard or is a
BSD-specific service.  As described in RFC 1078, TCPMUX services are
nonstandard services that do not have a well-known port assigned to
them.  They are invoked from inetd when a program connects to the
"tcpmux" well-known port and specifies the service name.  This feature
is useful for adding locally-developed servers.

   The service-name entry is the name of a valid service in the file
`/etc/services'. For "internal" services (discussed below), the service
name must be the official name of the service (that is, the first entry
in `/etc/services'). For TCPMUX services, the value of the service-name
field consists of the string "tcpmux" followed by a slash and the
locally-chosen service name.  The service names listed in /etc/services
and the name "help" are reserved.  Try to choose unique names for your
TCPMUX services by prefixing them with your organization's name and
suffixing them with a version number.

   The socket-type should be one of "stream", "dgram", "raw", "rdm", or
"seqpacket", depending on whether the socket is a stream, datagram,
raw, reliably delivered message, or sequenced packet socket.  TCPMUX
services must use "stream".

   The protocol must be a valid protocol as given in /etc/protocols.
Examples might be "tcp" or "udp". TCPMUX services must use "tcp".

   The wait/nowait entry specifies whether the server that is invoked
by inetd will take over the socket associated with the service access
point, and thus whether inetd should wait for the server to exit before
listening for new service requests.  Datagram servers must use "wait",
as they are always invoked with the original datagram socket bound to
the specified service address.  These servers must read at least one
datagram from the socket before exiting.  If a datagram server connects
to its peer, freeing the socket so inetd can received further messages
on the socket, it is said to be a "multi-threaded" server; it should
read one datagram from the socket and create a new socket connected to
the peer.  It should fork, and the parent should then exit to allow
inetd to check for new service requests to spawn new servers.  Datagram
servers which process all incoming datagrams on a socket and eventually
time out are said to be "single-threaded". Comsat(8),  (biff(1))  and
talkd(8) are both examples of the latter type of datagram server.
Tftpd(8) is an example of a multi-threaded datagram server.

   Servers using stream sockets generally are multi-threaded and use the
"nowait" entry.  Connection requests for these services are accepted by
inetd, and the server is given only the newly-accepted socket connected
to a client of the service.  Most stream-based services operate in this
manner.  Stream-based servers that use "wait" are started with the
listening service socket, and must accept at least one connection
request before exiting.  Such a server would normally accept and
process incoming connection requests until a timeout.  TCPMUX services
must use "nowait".

   The user entry should contain the user name of the user as whom the
server should run.  This allows for servers to be given less permission
than root.

   The server-program entry should contain the pathname of the program
which is to be executed by inetd when a request is found on its socket.
If inetd provides this service internally, this entry should be
"internal".

   The server program arguments should be just as arguments normally
are, starting with argv[0], which is the name of the program.  If the
service is provided internally, the word "internal" should take the
place of this entry.

   The inetd program provides several "trivial" services internally by
use of routines within itself.  These services are "echo", "discard",
"chargen" (character generator), "daytime" (human readable time), and
"time" (machine readable time, in the form of the number of seconds
since midnight, January 1, 1900).  All of these services are tcp based.
For details of these services, consult the appropriate RFC from the
Network Information Center.

   The inetd program rereads its configuration file when it receives a
hangup signal, SIGHUP. Services may be added, deleted or modified when
the configuration file is reread.

4.3 TCPMUX
==========

RFC 1078 describes the TCPMUX protocol: "A TCP client connects to a
foreign host on TCP port 1.  It sends the service name followed by a
carriage-return line-feed <CRLF>.  The service name is never case
sensitive.  The server replies with a single character indicating
positive (+) or negative (-) acknowledgment, immediately followed by an
optional message of explanation, terminated with a <CRLF>.  If the
reply was positive, the selected protocol begins; otherwise the
connection is closed."  The program is passed the TCP connection as
file descriptors 0 and 1.

   If the TCPMUX service name begins with a "+", inetd returns the
positive reply for the program.  This allows you to invoke programs
that use stdin/stdout without putting any special server code in them.

   The special service name "help" causes inetd to list TCPMUX services
in `inetd.conf'.

     Here are several example service entries for the various types of
     services:

     ftp           stream  tcp   nowait root  /usr/libexec/ftpd       ftpd -l
     ntalk         dgram   udp   wait   root  /usr/libexec/ntalkd     ntalkd
     tcpmux/+date  stream  tcp   nowait guest /bin/date               date
     tcpmux/phonebook stream tcp nowait guest /usr/bin/phonebook   phonebook

4.4 Error Messages
==================

The inetd server logs error messages using syslog(3).  Important error
messages and their explanations are:

`service/protocol server failing (looping), service terminated.'
     The number of requests for the specified service in the past
     minute exceeded the limit. The limit exists to prevent a broken
     program or a malicious user from swamping the system.  This
     message may occur for several reasons: 1) there are lots of hosts
     requesting the service within a short time period, 2) a 'broken'
     client program is requesting the service too frequently, 3) a
     malicious user is running a program to invoke the service in a
     'denial of service' attack, or 4) the invoked service program has
     an error that causes clients to retry quickly.  Use the [-R]
     option, as described above, to change the rate limit.  Once the
     limit is reached, the service will be reenabled automatically in
     10 minutes.

`service/protocol: No such user 'user', service ignored'
`service/protocol: getpwnam: user: No such user'
     No entry for user exists in the passwd file. The first message
     occurs when inetd (re)reads the configuration file. The second
     message occurs when the service is invoked.  the service will be
     reenabled automatically in 10 minutes.

`service/protocol: No such user 'user', service ignored'
`service/protocol: getpwnam: user: No such user'
     No entry for user exists in the passwd file. The first message
     occurs when inetd (re)reads the configuration file. The second
     message occurs when the service is invoked.

`service: can't set uid number'
`service: can't set gid number'
     The user or group ID for the entry's user is invalid.

5 ping
******

`Ping' uses the ICMP protocol's mandatory ECHO_REQUEST datagram to
elicit an ICMP ECHO_RESPONSE from a host or gateway.  ECHO_REQUEST
datagrams ("pings") have an IP and ICMP header, followed by a "struct
timeval" and then an arbitrary number of "pad" bytes used to fill out
the packet.

5.1 Invoking
============

The options are as follows:

`--echo'
     Send ICMP_ECHO requests (default).

`--address'
     Send ICMP_ADDRESS packets.

`--timestamp'
     Send ICMP_TIMESTAMP packets.

`--router'
     Send ICMP_ROUTERDISCOVERY packets.

`-c N'

`--count=N'
     Stop after sending (and receiving) count ECHO_RESPONSE packets.

`-d'
`-debug'
     Set the SO_DEBUG option on the socket being used.

`-i N'
`--interval=N'
     Wait N seconds between sending each packet. The default is to wait
     for one second between each packet.  This option is incompatible
     with the -f option.

`-n'
`--numeric'
     Numeric output only.  No attempt will be made to lookup symbolic
     names for host addresses.

`-r'
`--ignore-routing'
     Bypass the normal routing tables and send directly to a host on an
     attached network.  If the host is not on a directly-attached
     network, an error is returned.  This option can be used to ping a
     local host through an interface that has no route through it
     (e.g., after the interface was dropped by routed(8)).

`-v'
`--verbose'
     Verbose output.  ICMP packets other than ECHO_RESPONSE that are
     received are listed.

`-f'
`--flood'
     Flood ping.  Outputs packets as fast as they come back or one
     hundred times per second, whichever is more.  For every
     ECHO_REQUEST sent a period "." is printed, while for every
     ECHO_REPLY received a backspace is printed.  This provides a rapid
     display of how many packets are being dropped.  Only the
     super-user may use this option.  This can be very hard on a network
     and should be used with caution.

`-l N'

`--preload=N'
     If N is specified, ping sends that many packets as fast as
     possible before falling into its normal mode of behavior.

`-p PAT'
`--pattern=PAT'
     You may specify up to 16 "pad" bytes to fill out the packet you
     send.  This is useful for diagnosing data-dependent problems in a
     network.  For example, "-p ff" will cause the sent packet to be
     filled with all ones.

`-q'
`--quiet'
     Quiet output.  Nothing is displayed except the summary lines at
     startup time and when finished.

`-R'
`--route'
     Record route.  Includes the RECORD_ROUTE option in the
     ECHO_REQUEST packet and displays the route buffer on returned
     packets.  Note that the IP header is only large enough for nine
     such routes.  Many hosts ignore or discard this option.

`-s N'
`--size=N'
     Specifies the number of data bytes to be sent.  The default is 56,
     which translates into 64 ICMP data bytes when combined with the 8
     bytes of ICMP header data.

   When using ping for fault isolation, it should first be run on the
local host, to verify that the local network interface is up and
running.  Then, hosts and gateways further and further away should be
"pinged".  Round-trip times and packet loss statistics are computed.
If duplicate packets are received, they are not included in the packet
loss calculation, although the round trip time of these packets is used
in calculating the minimum/average/maximum round-trip time numbers.
When the speci- fied number of packets have been sent (and received) or
if the program is terminated with a SIGINT, a brief summary is
displayed.

   This program is intended for use in network testing, measurement and
man- agement.  Because of the load it can impose on the network, it is
unwise to use ping during normal operations or from automated scripts.

5.2 ICMP Packet Details
=======================

An IP header without options is 20 bytes.  An ICMP ECHO_REQUEST packet
contains an additional 8 bytes worth of ICMP header followed by an
arbitrary amount of data.  When a packetsize is given, this indicated
the size of this extra piece of data (the default is 56).  Thus the
amount of data received inside of an IP packet of type ICMP ECHO_REPLY
will always be 8 bytes more than the requested data space (the ICMP
header).

   If the data space is at least eight bytes large, ping uses the first
eight bytes of this space to include a timestamp which it uses in the
computation of round trip times.  If less than eight bytes of pad are
specified, no round trip times are given.

5.3 Duplicate And Damaged Packets
=================================

Ping will report duplicate and damaged packets.  Duplicate packets
should never occur, and seem to be caused by inappropriate link-level
retransmissions.  Duplicates may occur in many situations and are rarely
(if ever) a good sign, although the presence of low levels of
duplicates may not always be cause for alarm.

   Damaged packets are obviously serious cause for alarm and often
indicate broken hardware somewhere in the ping packet's path (in the
network or in the hosts).

5.4 Trying Different Data Patterns
==================================

The (inter)network layer should never treat packets differently
depending on the data contained in the data portion.  Unfortunately,
data-dependent problems have been known to sneak into networks and
remain undetected for long periods of time.  In many cases the
particular pattern that will have problems is something that doesn't
have sufficient "transitions", such as all ones or all zeros, or a
pattern right at the edge, such as almost all zeros.  It isn't
necessarily enough to specify a data pattern of all zeros (for example)
on the command line because the pattern that is of interest is at the
data link level, and the relationship between what you type and what
the controllers transmit can be complicated.

   This means that if you have a data-dependent problem you will
probably have to do a lot of testing to find it.  If you are lucky, you
may manage to find a file that either can't be sent across your network
or that takes much longer to transfer than other similar length files.
You can then examine this file for repeated patterns that you can test
using the -p option of ping.

5.5 TTL Details
===============

The TTL value of an IP packet represents the maximum number of IP
routers that the packet can go through before being thrown away.  In
current practice you can expect each router in the Internet to
decrement the TTL field by exactly one.

   The TCP/IP specification states that the TTL field for TCP packets
should be set to 60, but many systems use smaller values (4.3 BSD uses
30, 4.2 used 15).

   The maximum possible value of this field is 255, and most Unix
systems set the TTL field of ICMP ECHO_REQUEST packets to 255.  This is
why you will find you can "ping" some hosts, but not reach them with
telnet(1) or ftp(1).

   In normal operation ping prints the ttl value from the packet it
receives.  When a remote system receives a ping packet, it can do one of
three things with the TTL field in its response:

*
     Not change it; this is what Berkeley Unix systems did before the
     4.3BSD-Tahoe release.  In this case the TTL value in the received
     packet will be 255 minus the number of routers in the round-trip
     path.

*
     Set it to 255; this is what current Berkeley Unix systems do.  In
     this case the TTL value in the received packet will be 255 minus
     the number of routers in the path from the remote system to the
     pinging host.

*
     Set it to some other value.  Some machines use the same value for
     ICMP packets that they use for TCP packets, for example either 30
     or 60.  Others may use completely wild values.

   Many Hosts and Gateways ignore the RECORD_ROUTE option.

   The maximum IP header length is too small for options like
RECORD_ROUTE to be completely useful.  There's not much that that can
be done about this, however.

   Flood pinging is not recommended in general, and flood pinging the
broadcast address should only be done under very controlled conditions.

6 rcp
*****

`Rcp' copies files between machines.  Each file or directory argument
is either a remote file name of the form "rname@rhost:path", or a local
file name (containing no `:' characters, or a `/' before any `:'s).

6.1 Invoking
============

The options are as follows :

`-K'
`--kerberos'
     Turns off all Kerberos authentication.

`-k'
`--realm=REALM'
     The option requests rcp to obtain tickets for the remote host in
     REALM realm instead of the remote host's realm as determined by
     krb_realmofhost(3).

`-p'
`--preserve'
     Causes rcp to attempt to preserve (duplicate) in its copies the
     modification times and modes of the source files, ignoring the
     umask. By default, the mode and owner of file2 are preserved if it
     already existed; otherwise the mode of the source file modified by
     the umask(2) on the destination host is used.

`-r'
`--recursive'
     If any of the source files are directories, rcp copies each subtree
     rooted at that name; in this case the destination must be a
     directory.

`-x'
`--encrypt'
     Turns on DES encryption for all data passed via the rcp session.
     This may impact response time and CPU utilization, but provides
     increased security.

   `rcp' doesn't detect all cases where the target of a copy might be a
file in cases where only a directory should be legal.

   Is confused by any output generated by commands in a .login,
.profile, or .cshrc file on the remote host.

   The destination user and hostname may have to be specified as
"rhost.rname" when the destination machine is running the 4.2BSD version
of `rcp'.

7 rexecd
********

`Rexecd' is the server for the rexec(3) routine.  The server provides
remote execution facilities with authentication based on user names and
passwords.

   `Rexecd' listens for service requests at the port indicated in the
"exec" service specification; see services(5).  When a service request
is received the following protocol is initiated:

  1. The server reads characters from the socket up to a NUL (`\0')
     byte.  The resultant string is interpreted as an ASCII number,
     base 10.

  2. If the number received in step 1 is non-zero, it is interpreted as
     the port number of a secondary stream to be used for the stderr. A
     second connection is then created to the specified port on the
     client's machine.

  3. A NUL terminated user name of at most 16 characters is retrieved on
     the initial socket.

  4. A NUL terminated, unencrypted password of at most 16 characters is
     retrieved on the initial socket.

  5. A NUL terminated command to be passed to a shell is retrieved on
     the initial socket.  The length of the command is limited by the
     upper bound on the size of the system's argument list.

  6. `Rexecd' then validates the user as is done at login time and, if
     the authentication was successful, changes to the user's home
     directory, and establishes the user and group protections of the
     user.  If any of these steps fail the connection is aborted with a
     diagnostic message returned.

  7. A NUL byte is returned on the initial socket and the command line
     is passed to the normal login shell of the user.  The shell
     inherits the network connections established by rexecd.

7.1 Diagnostics
===============

Except for the last one listed below, all diagnostic messages are
returned on the initial socket, after which any network connections are
closed.  An error is indicated by a leading byte with a value of 1 (0
is returned in step 7 above upon successful completion of all the steps
prior to the command execution).

`username too long'
     The name is longer than 16 characters.

`password too long'
     The password is longer than 16 characters.

`command too long'
     The command line passed exceeds the size of the argument list (as
     configured into the system).

`Login incorrect.'
     No password file entry for the user name existed.

`Password incorrect.'
     The wrong password was supplied.

`No remote directory.'
     The chdir command to the home directory failed.

`Try again.'
     A fork by the server failed.

`<shellname>: ...'
     The user's login shell could not be started.  This message is
     returned on the connection associated with the stderr, and is not

   Indicating "Login incorrect" as opposed to "Password incorrect" is a
security breach which allows people to probe a system for users with
null passwords.

8 rlogin
********

`rlogin' command logs into a specified remote host and connects your
local terminal to the remote host.  The remote terminal type is the
same as that given in the _TERM_ local environment variable.  The
terminal or window size is also the same, if the remote host supports
them, and any changes in size are transferred.

   When using the `rlogin' command, you can create a link to your path
using a host name as the link name. For example:

     #
     # ln -s /usr/bin/rlogin HostName
     # Hostname -8

   Using HOSTNAME automatically uses the `rlogin' to log in to the
remote host named HOSTNAME.

   `rlogin' allows access to the remote host without the use of a
passwd.  For details, see rcmd (libc).

8.1 Invoking
============

The options are as follows :

`-8'
`--8-bit'
     Allows an eight-bit input data path at all times; otherwise parity
     bits are stripped except when the remote side's stop and start
     characters are other than ^S/^Q .

`-E'

`--no-escape'
`--no-escape'
     Stops any character from being recognized as an escape character.
     When used with the -8 option, this provides a completely
     transparent connection.

`-K'
`--kerberos'
     Turns off all Kerberos authentication.

`-d'
`--debug'
     Turns on socket debugging (see setsockopt(2))  on the TCP sockets
     used for communication with the remote host.

`-e'
`--escape=CHAR'
     Allows user specification of the escape character, which is "~" by
     default.  This specification may be as a literal character, or as
     an octal value in the form \nnn.

`-k'
`--realm=REALM'
     The option requests rlogin to obtain tickets for the remote host
     in REALM realm instead of the remote host's realm as determined by
     krb_realmofhost(3).

`-x'
`--encrypt'
     Turns on DES encryption for all data passed via the rlogin
     session.  This may impact response time and CPU utilization, but
     provides increased security.

   A line of the form "<escape char>." disconnects from the remote host.
Similarly, the line "<escape char>^Z" will suspend the rlogin session,
and "<escape char><delayed-suspend char>" suspends the send portion of
the rlogin, but allows output from the remote system.  By default, the
tilde ("~") character is the escape character, and normally control-Y
("^Y") is the delayed-suspend character.

   All echoing takes place at the remote site, so that (except for
delays) the rlogin is transparent.  Flow control via ^S/^Q, if
supported, stop and start the flow of information, flushing of input
and output on interrupts are handled properly.

   On the server side the iruserok() and ruserok() functions are used to
authenticate see the appropriate man page for more information, if
supported.

8.2 Kerberos Authentication
===========================

If `rlogin' was compiled with kerberos support, optins -x, -k, -K are
available.  Each user may have a private authorization list in the file
.klogin in their home directory.  Each line in this file should contain
a Kerberos principal name of the form principal.instance@realm. If the
originating user is authenticated to one of the principals named in
.klogin, access is granted to the account.  The principal
accountname.@localrealm is granted access if there is no .klogin file.
Otherwise a login and password will be prompted for on the remote
machine as in login(1).  To avoid certain security problems, the
.klogin file must be owned by the remote user.  If Kerberos
authentication fails, a warning message is printed and the standard
Berkeley rlogin is used instead.

9 rlogind
*********

`rlogind' is the server for the rlogin(1) program.  The server provides
a remote login facility with authentication based on privileged port
numbers from trusted hosts.

   `Rlogind' listens for service requests at the port indicated in the
"login" service specification; see services(5).  When a service request
is received the following protocol is initiated:
  1. The server checks the client's source port.  If the port is not in
     the range 512-1023, the server aborts the connection.

  2. The server checks the client's source address and requests the
     corresponding host name (see gethostbyaddr(3),  hosts(5) and
     named(8)).  If the hostname cannot be determined, the dot-notation
     representation of the host address is used.  If the hostname is in
     the same domain as the server (according to the last two
     components of the domain name), or if the -a option is given, the
     addresses for the hostname are requested, verifying that the name
     and address correspond.  Normal authentication is bypassed if the
     address verification fails.

   Once the source port and address have been checked, rlogind proceeds
with the authentication process described in rshd(8).  It then
allocates a pseudo terminal (see pty(4)),  and manipulates file
descriptors so that the slave half of the pseudo terminal becomes the
stdin, stdout, and stderr for a login process.  The login process is an
instance of the login(1) program, invoked with the -f option if
authentication has succeeded.  If automatic authentication fails, the
user is prompted to log in as if on a standard terminal line.

   The parent of the login process manipulates the master side of the
pseudo terminal, operating as an intermediary between the login process
and the client instance of the rlogin program.  In normal operation,
the packet protocol described in pty(4) is invoked to provide `^S/^Q'
type facilities and propagate interrupt signals to the remote programs.
The login process propagates the client terminal's baud rate and
terminal type, as found in the environment variable, `TERM'; see
environ(7).  The screen or window size of the terminal is requested
from the client, and window size changes from the client are propagated
to the pseudo terminal.

   Transport-level keepalive messages are enabled unless the -n option
is client instance of the rlogin program.  In normal operation, the
packet protocol described in pty(4) is invoked to provide `^S/^Q' type
facilities and propagate interrupt signals to the remote programs.  The
login process propagates the client terminal's baud rate and terminal
type, as found in the environment variable, `TERM'; see environ(7).
The screen or window size of the terminal is requested from the client,
and window size changes from the client are propagated to the pseudo
terminal.

   Transport-level keepalive messages are enabled unless the -n option
is present.  The use of keepalive messages allows sessions to be timed
out if the client crashes or becomes unreachable.

   See ruserok (libc), for details.

9.1 Invoking
============

The options are as follows :

`-a'
`--verify-hostname'
     Ask hostname for verification.

`-d'
`--daemon'
     Daemon mode.

`-l'
`--no-rhosts'
     Ignore .rhosts file.

`-L'
`--local-domain=NAME'
     Set local domain name.

`-n'
`--no-keepalive'
     Do not set SO_KEEPALIVE.

`-k'
`--kerberos'
     Use kerberos IV authentication.

`-x'
`--encrypt'
     Turns on DES encryption for all data passed via the rlogind
     session.  This may impact response time and CPU utilization, but
     provides increased security.

`-D'
`--debug[=LEVEL]'
     Set debug level, not implemented.

`-h'
`--help'
     Display usage instructions.

`-V'
`--version'
     Display program version.

`-o'
`--allow-root'
     Allow uid == 0 to login, disable by default\n"

`-p'
`--port=PORT'
     Listen on given port (valid only in daemon mode).

`-r'
`--reverse-required'
     Required  Require reverse resolving of a remote host IP.

9.2 Diagnostics
===============

All initial diagnostic messages are indicated by a leading byte with a
value of 1, after which any network connections are closed.  If there
are no errors before login is invoked, a null byte is returned as in
indication of success.

`Try again.'
     A fork by the server failed.

   The authentication procedure used here assumes the integrity of each
client machine and the connecting medium.  This is insecure, but is
useful in an "open" environment.

10 rsh
******

`Rsh' executes command on host and copies its standard input to the
remote command, the standard output of the remote command to its
standard output, and the standard error of the remote command to its
standard error.  Interrupt, quit and terminate signals are propagated
to the remote command; `rsh' normally terminates when the remote
command does.

   When using the `rsh' command, you can create a link to your path
using a host name as the link name. For example:

     #
     # ln -s /usr/bin/rsh HostName
     # Hostname ls

   HOSTNAME will be passed to `rsh' as the default host.

   `rsh' allows access to the remote host without the use of a passwd.
For details, see rcmd (libc).

10.1 Invoking
=============

The options are as follows :

`-K'
`--kerberos'
     Turns off all Kerberos authentication.

`-d'
`--debug'
     Turns on socket debugging (see setsockopt(2))  on the TCP sockets
     used for communication with the remote host.

`-k'
`--realm=REALM'
     The option requests rsh to obtain tickets for the remote host in
     REALM realm instead of the remote host's realm as determined by
     krb_realmofhost(3).

`-x'
`--encrypt'
     Turns on DES encryption for all data passed via the rsh session.
     This may impact response time and CPU utilization, but provides
     increased security.

`-l'
`--user'
     By default, the remote username is the same as the local username.
     The -l option or the username@host format allow the remote name to
     be specified.  Kerberos authentication is used, and authorization
     is determined as in rlogin(1).

   If no command is specified, you will be logged in on the remote host
using rlogin(1).

   Shell metacharacters which are not quoted are interpreted on local
machine, while quoted metacharacters are interpreted on the remote
machine.

     For example, the command

     # rsh otherhost cat remotefile >> localfile

     appends the remote file remotefile to the local file localfile, while

     # rsh otherhost cat remotefile ">>" other_remotefile

     appends remotefile to other_remotefile.

11 rshd
*******

The `rshd' server is the server for the rcmd(3) routine and,
consequently, for the rsh(1) program.  The server provides remote
execution facilities with authentication based on privileged port
numbers from trusted hosts.  The `rshd' server listens for service
requests at the port indicated in the "cmd" service specification; see
services(5).  When a service request is received the following protocol
is initiated:

  1. The server checks the client's source port.  If the port is not in
     the range 512-1023, the server aborts the connection.

  2. The server reads characters from the socket up to a null (`\0')
     byte.  The resultant string is interpreted as an ASCII number,
     base 10.

  3. If the number received in step 2 is non-zero, it is interpreted as
     the port number of a secondary stream to be used for the stderr. A
     second connection is then created to the specified port on the
     client's machine.  The source port of this second connection is
     also in the range 512-1023.

  4. The server checks the client's source address and requests the
     corresponding host name (see gethostbyaddr(3),  hosts(5) and
     named(8)).  If the hostname cannot be determined, the dot-notation
     representation of the host address is used.  If the hostname is in
     the same domain as the server (according to the last two
     components of the domain name), or if the -a option is given, the
     addresses for the hostname are requested, verifying that the name
     and address correspond.  If address verification fails, the
     connection is aborted with the message, "Host address mismatch."

  5. A null terminated user name of at most 16 characters is retrieved
     on the initial socket.  This user name is interpreted as the user
     identity on the client's machine.

  6. A null terminated user name of at most 16 characters is retrieved
     on the initial socket.  This user name is interpreted as a user
     identity to use on the server's machine.

  7. A null terminated command to be passed to a shell is retrieved on
     the initial socket.  The length of the command is limited by the
     upper bound on the size of the system's argument list.

  8. Rshd then validates the user using ruserok(3),  which uses the file
     /etc/hosts.equiv and the .rhosts file found in the user's home
     directory.  The -l option prevents ruserok(3) from doing any
     validation based on the user's ".rhosts" file, unless the user is
     the superuser.

  9. If the file /etc/nologin exists and the user is not the superuser,
     the connection is closed.

 10. A null byte is returned on the initial socket and the command line
     is passed to the normal login shell of the user.  The shell
     inherits the network connections established by `rshd'.

 11. Transport-level keepalive messages are enabled unless the -n
     option is present.  The use of keepalive messages allows sessions
     to be timed out if the client crashes or becomes unreachable.

 12. The -L option causes all successful accesses to be logged to
     syslogd(8) as auth.info messages.

   See ruserok (libc), for details.

11.1 Invoking
=============

The options are as follows :

`-a'
`--verify-hostname'
     Ask hostname for verification.

`-l'
`--no-rhosts'
     Ignore .rhosts file.

`-L'
`--local-domain=NAME'
     Set local domain name.

`-n'
`--no-keepalive'
     Do not set SO_KEEPALIVE.

`-k'
`--kerberos'
     Use kerberos IV authentication.

`-x'
`--encrypt'
     Turns on DES encryption for all data passed via the `rshd' session.
     This may impact response time and CPU utilization, but provides
     increased security.

`-D'
`--debug[=LEVEL]'
     Set debug level, not implemented.

`-h'
`--help'
     Display usage instructions.

`-V'
`--version'
     Display program version.

11.2 Diagnostics
================

Except for the last one listed below, all diagnostic messages are
returned on the initial socket, after which any network connections are
closed.  An error is indicated by a leading byte with a value of 1 (0
is returned in step 10 above upon successful completion of all the
steps prior to the execution of the login shell).

`Locuser too long'
     The name of the user on the client's machine is longer than 16
     characters.

`Ruser too long'
     The name of the user on the remote machine is longer than 16
     characters.

`Command too long'
     The command line passed exceeds the size of the argument list (as
     configured into the system).

`Login incorrect'
     No password file entry for the user name existed.

`Remote directory'
     The chdir command to the home directory failed.

`Permission denied'
     The authentication procedure described above failed.

`Can't make pipe.'
     The pipe needed for the stderr, wasn't created.

`Can't fork; try again.'
     A fork by the server failed.

`<shellname>: ...'
     The user's login shell could not be started.  This message is re-
     turned on the connection associated with the stderr, and is not
     preceded by a flag byte.

   The authentication procedure used here assumes the integrity of each
client machine and the connecting medium.  This is insecure, but is
useful in an "open" environment.

12 logger
*********

`logger' is a program to make entries in the system log files.  It
provides a shell command interface to the system log module.  See
Syslog (libc), for details.

   The message can contain a priority code, which should be a preceding
decimal number in angle braces, for example, `<5>'.  This priority code
should map into the priorities defined in the include file
`<sys/syslog.h>'.

12.1 Invoking
=============

The options are as follows :

`-i'
     Log the process ID of the logger process with each line.

`-s'
     Log the message to standard error, as well as the system log.  This
     option might not be supported on all systems.

`-f FILE'
`--file=FILE'
     Log the content of the specified file.

`-p PRIORITY'
`--priority=PRIORITY'
     Enter the message with the specified priority.  The priority may be
     specified numerically or as a `facility.level' pair.  For example,
     `-p local3.info' logs the message at the informational level in
     the `local3' facility.  The default is `user.notice'.

     The actual list of supported facilities and levels is system
     specific.

`-t TAG'
`--tag=TAG'
     Mark every line in the log with the specified tag.

   The options are followed by the message which should be written to
the log.  If not specified, and the -f flag is not provided, standard
input is logged.

   The logger utility exits 0 on success, and >0 if an error occurs.

   The following examples illustrate the usage of the `logger' command.

     logger System rebooted

     logger -p local0.notice -t HOSTIDM -f /dev/idmc

13 syslogd
**********

`syslogd' is a system service that provides error logging facility.
Messages are read from the UNIX domain socket `/dev/log', from an
Internet domain socket specified in `/etc/services', and from the
special device `/dev/klog' (to read kernel messages).

   `syslogd' creates the file `/var/run/syslog.pid', and stores its
process id there.  This can be used to kill or reconfigure `syslogd'.

   The message sent to `syslogd' should consist of a single line.  The
message can contain a priority code, which should be a preceding
decimal number in angle braces, for example, `<5>'.  This priority code
should map into the priorities defined in the include file
`sys/syslog.h'.

13.1 Invoking
=============

The options are as follows:

`-f FILE'
`--rcfile=FILE'
     Override configuration (the default file is `/etc/syslog.conf').

`--pidfile=FILE'
     Override pidfile (the default file is `/var/run/syslogd.pid').

`-n'
`--no-detach'
     Do not enter daemon mode.

`-d'
`--debug'
     Print debug information (implies `-n').

`-p FILE'

`--socket=FILE'
     Override default UNIX domain socket `/dev/log'.

`-a SOCKET'
     Add UNIX socket to listen.  An unlimited number of sockets is
     allowed.

`-r'
`--inet'
     Receive remote messages via Internet domain socket.

`--no-unixaf'
     Do not listen on UNIX domain sockets (overrides `-a' and `-p').

`--no-klog'
     Do not listen to kernel log device `/dev/klog'.

`--no-forward'
     Do not forward any messages (overrides `-h').

`-h'

`--hop'
     Forward messages from remote hosts.

`-m INTERVAL'

`--mark=INTERVAL'
     Specify timestamp interval in logs (0 for no timestamps).

`-l HOSTLIST'
     Log hosts in HOSTLIST by their hostname. Multiple lists are
     allowed.

`-s DOMAINLIST'
     List of domains which should be stripped from the FQDN of hosts
     before logging their name.  Multiple lists are allowed.

13.2 Configuration file
=======================

`syslogd' reads its configuration file when it starts up and whenever
it receives a hangup signal.  The `syslog.conf' file is the
configuration file for the `syslogd' program.  It consists of lines
with two fields: the _selector_ field which specifies the types of
messages and priorities to which the line applies, and an _action_
field which specifies the action to be taken if a message `syslogd'
receives matches the selection criteria.  The _selector_ field is
separated from the action field by one or more tab or space characters.
A rule can be splitted in several lines if all lines except the last
are terminated with a backslash `\'.

   The Selectors function are encoded as a facility, a period (`.'),
and a level, with no intervening white-space.  Both the facility and
the level are case insensitive.

   The facility describes the part of the system generating the message,
and is one of the following keywords: `auth', `authpriv', `cron',
`daemon', `kern', `lpr', `mail', `mark', `news', `syslog', `user',
`uucp' and `local0' through `local7'.  These keywords (with the
exception of `mark') correspond to the similar `LOG_' values specified
to the `openlog' and `syslog' library routines.  See Syslog (libc),
for details.

   The level describes the severity of the message, and is a keyword
from the following ordered list (higher to lower): `emerg', `alert',
`crit', `err, warning', `notice' and `debug'.  These keywords
correspond to the similar `LOG_' values specified to the syslog library
routine.

   See syslog and vsyslog (libc), for a further
descriptions of both the facility and level keywords and their
significance.

   If a received message matches the specified facility and is of the
specified level (or a higher level), the action specified in the action
field will be taken.

   Multiple selectors may be specified for a single action by separating
them with semicolon (`;') characters.  It is important to note,
however, that each selector can modify the ones preceding it.

   Multiple facilities may be specified for a single level by separating
them with comma (`,') characters.

   An asterisk (`*') can be used to specify all facilities or all
levels.  Two asterisks (`**') specifie all facilities not named
previously in the configuration file.

   By default, a level applies to all messages with the same or higher
level. The equal (`=') character can be prepended to a level to
restrict this line of the configuration file to messages with the very
same level.

   An exclamation mark (`!') prepended to a level or the asterisk means
that this line of the configuration file does not apply to the
specified level (and higher ones). In conjunction with the equal sign,
you can exclude single levels as well.

   The special facility _mark_ receives a message at priority `info'
every 20 minutes.  This is not enabled by a facility field containing
an asterisk.

   The special level `none' disables a particular facility.

   The action field of each line specifies the action to be taken when
the selector field selects a message.  There are five forms:

   * A pathname (beginning with a leading slash).  Selected messages are
     appended to the file.

     You may prepend a minus (`-') to the path to omit syncing the file
     after each message log. This can cause data loss at system
     crashes, but increases performance for programs which use logging
     extensively.

   * A named pipe (fifo), beginning with a vertical bar (`|') followed
     by a pathname. The pipe must be created with `mkfifo'(8) before
     `syslogd' reads its configuration file.  This feature is
     especially useful fo debugging.

   * A hostname (preceded by an at (`@') sign).  Selected messages are
     forwarded to `syslogd' on the named host.

   * A comma separated list of users.  Selected messages are written to
     those users if they are logged in.

   * An asterisk.  Selected messages are written to all logged-in users.

     Blank lines and lines whose first non-blank character is a hash
     (`#') character are ignored.

   A configuration file might appear as follows:

     # Log all kernel messages, authentication messages of
     # level notice or higher and anything of level err or
     # higher to the console.
     # Don't log private authentication messages!
     *.err;kern.*;auth.notice;authpriv.none  /dev/console

     # Log anything (except mail) of level info or higher.
     # Don't log private authentication messages!
     *.info;mail.none;authpriv.none          /var/log/messages

     # The authpriv file has restricted access.
     authpriv.*                              /var/log/secure

     # Log all the mail messages in one place.
     mail.*                                  /var/log/maillog

     # Everybody gets emergency messages, plus log them on another
     # machine.
     *.emerg                                 *
     *.emerg                                 @arpa.berkeley.edu

     # Root and Eric get alert and higher messages.
     *.alert                                 root,eric

     # Save mail and news errors of level err and higher in a
     # special file.
     uucp,news.crit                          /var/log/spoolerr

   The effects of multiple selectors are sometimes not intuitive.  For
example `mail.crit,*.err' will select the `mail' facility messages at
the level of `err' or higher, not at the level of `crit' or higher.

14 talk
*******

`Talk' is a visual communication program which copies lines from your
terminal to that of another user.

14.1 Invoking
=============

The options are as follows:

`person'
     If you wish to talk to someone on your own machine, then person is
     just the person's login name.  If you wish to talk to a user on
     another host, then person is of the form `user@host'.

`ttyname'
     If you wish to talk to a user who is logged in more than once, the
     ttyname argument may be used to indicate the appropriate terminal
     name, where ttyname is of the form `ttyXX'.

   When first called, talk sends the message
                Message from TalkDaemon@his_machine...
                talk: connection requested by your_name@your_machine.
                talk: respond with: talk your_name@your_machine

   to the user you wish to talk to. At this point, the recipient of the
message should reply by typing
                talk  your_name@your_machine

   It doesn't matter from which machine the recipient replies, as long
as his login-name is the same.  Once communication is established, the
two parties may type simultaneously, with their output appearing in
separate windows.  Typing control-L `^L' will cause the screen to be
reprinted, while your erase, kill, and word kill characters will behave
normally.  To exit, just type your interrupt character; talk then moves
the cursor to the bottom of the screen and restores the terminal to its
previous state.

   Permission to talk may be denied or granted by use of the mesg(1)
command.  At the outset talking is allowed.  Certain commands, in
particular nroff(1) and pr(1),  disallow messages in order to prevent
messy output.

   To exit, just type your interrupt character; talk then moves the
cursor to the bottom of the screen and restores the terminal to its
previous state.

   Permission to talk may be denied or granted by use of the mesg(1)
command.  At the outset talking is allowed.  Certain commands, in
particular nroff(1) and pr(1),  disallow messages in order to prevent
messy output.

   The version of talk(1) released with 4.3BSD uses a protocol that is
incompatible with the protocol used in the version released with 4.2BSD.

15 talkd
********

`Talkd' is the server that notifies a user that someone else wants to
initiate a conversation.  It acts as a repository of invitations,
responding to requests by clients wishing to rendezvous to hold a
conversation.  In normal operation, a client, the caller, initiates a
rendezvous by sending a CTL_MSG to the server of type LOOK_UP (see
<protocols/talkd.h>). This causes the server to search its invitation
tables to check if an invitation currently exists for the caller (to
speak to the callee specified in the message).  If the lookup fails,
the caller then sends an ANNOUNCE message causing the server to
broadcast an announcement on the callee's login ports requesting
contact.  When the callee responds, the local server uses the recorded
invitation to respond with the appropriate rendezvous address and the
caller and callee client programs establish a stream connection through
which the conversation takes place.

15.1 Invoking
=============

The options are as follows:

`-a FILE'
`--acl=FILE'
     Read site-wide ACLs from FILE.

`-d'

`--debug'
     Enable debugging.

`-i SECONDS'
`--idle-timeout=SECONDS'
     Set idle timeout value.

`-r SECONDS'
`--request-ttl=SECONDS'
     Set request time-to-live value.

`-t SECONDS'

`--timeout=SECONDS'
     Set timeout value.

16 tftp
*******

`Tftp' is the user interface to the Internet TFTP (Trivial File
Transfer Protocol), which allows users to transfer files to and from a
remote machine.  The remote host may be specified on the command line,
in which case tftp uses host as the default host for future transfers
(see the connect command below).

16.1 Invoking
=============

tftp [host]

16.2 Commands
=============

Once tftp is running, it issues the prompt and recognizes the following
commands:

`? command-name ...'
     Print help information.

`ascii'
     Shorthand for "mode ascii"

`binary'
     Shorthand for "mode binary"

`connect host-name [port]'
     Set the host (and optionally port) for transfers.  Note that the
     TFTP protocol, unlike the FTP protocol, does not maintain
     connections between transfers; thus, the connect command does not
     actually create a connection, but merely remembers what host is to
     be used for transfers.  You do not have to use the connect
     command; the remote host can be specified as part of the get or
     put commands.

`get filename'
`get remotename localname'
`get file1 file2 ... fileN'
     Get a file or set of files from the specified sources. Source can
     be in one of two forms: a filename on the remote host, if the host
     has already been specified, or a string of the form hosts:filename
     to specify both a host and filename at the same time.  If the
     latter form is used, the last hostname specified becomes the
     default for future transfers.

`mode transfer-mode'
     Set the mode for transfers; transfer-mode may be one of ascii or
     binary. The default is ascii.

`put file'
`put localfile remotefile'
`put file1 file2 ... fileN remote-directory'
     Put a file or set of files to the specified remote file or
     directory.  The destination can be in one of two forms: a filename
     on the remote host, if the host has already been specified, or a
     string of the form hosts:filename to specify both a host and
     filename at the same time.  If the latter form is used, the
     hostname specified becomes the default for future transfers.  If
     the remote-directory form is used, the remote host is assumed to
     be a UNIX machine.

`quit'
     Exit tftp. An end of file also exits.

`rexmt retransmission-timeout'
     Set the per-packet retransmission timeout, in seconds.

`status'
     Show current status.

`timeout total-transmission-timeout'
     Set the total transmission timeout, in seconds.

`trace'
     Toggle packet tracing.

`verbose'
     Toggle verbose mode.

   Because there is no user-login or validation within the TFTP
protocol, the remote site will probably have some sort of file-access
restrictions in place.  The exact methods are specific to each site and
therefore difficult to document here.

17 Reporting bugs
*****************

Email bug reports to <bug-inetutils@gnu.org>.  Be sure to include the
word "inetutils" somewhere in the "Subject:" field.

``syslogd''
     The effects of multiple selectors are sometimes not intuitive.
     For exam-      ple "mail.crit,*.err" will select "mail" facility
     messages at the      level of "err" or higher, not at the level of
     "crit" or higher.

Concept Index
*************

This is a general index of all issues discussed in this manual, with the
exception of the commands and command-line options.

Index
*****

This is an alphabetical list of all commands, command-line options, and
environment variables.