doc/pwmd.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
   2 <html>
   3 <!-- Created by GNU Texinfo 5.1, http://www.gnu.org/software/texinfo/ -->
   4 <head>
   5 <title>PWMD Manual</title>
   6
   7 <meta name="description" content="PWMD Manual">
   8 <meta name="keywords" content="PWMD Manual">
   9 <meta name="resource-type" content="document">
  10 <meta name="distribution" content="global">
  11 <meta name="Generator" content="makeinfo">
  12 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  13 <link href="#Top" rel="start" title="Top">
  14 <link href="#SEC_Contents" rel="contents" title="Table of Contents">
  15 <link href="dir.html#Top" rel="up" title="(dir)">
  16 <style type="text/css">
  17 <!--
  18 a.summary-letter {text-decoration: none}
  19 blockquote.smallquotation {font-size: smaller}
  20 div.display {margin-left: 3.2em}
  21 div.example {margin-left: 3.2em}
  22 div.indentedblock {margin-left: 3.2em}
  23 div.lisp {margin-left: 3.2em}
  24 div.smalldisplay {margin-left: 3.2em}
  25 div.smallexample {margin-left: 3.2em}
  26 div.smallindentedblock {margin-left: 3.2em; font-size: smaller}
  27 div.smalllisp {margin-left: 3.2em}
  28 kbd {font-style:oblique}
  29 pre.display {font-family: inherit}
  30 pre.format {font-family: inherit}
  31 pre.menu-comment {font-family: serif}
  32 pre.menu-preformatted {font-family: serif}
  33 pre.smalldisplay {font-family: inherit; font-size: smaller}
  34 pre.smallexample {font-size: smaller}
  35 pre.smallformat {font-family: inherit; font-size: smaller}
  36 pre.smalllisp {font-size: smaller}
  37 span.nocodebreak {white-space:nowrap}
  38 span.nolinebreak {white-space:nowrap}
  39 span.roman {font-family:serif; font-weight:normal}
  40 span.sansserif {font-family:sans-serif; font-weight:normal}
  41 ul.no-bullet {list-style: none}
  42 -->
  43 </style>
  44
  45
  46 </head>
  47
  48 <body lang="en" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
  49 <h1 class="settitle" align="center">PWMD Manual</h1>
  50
  51
  52
  53
  54 <a name="Top"></a>
  55 <div class="header">
  56 <p>
  57 Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
  58 </div>
  59 <h1 class="node-heading">Top</h1>
  60
  61
  62 <table class="menu" border="0" cellspacing="0">
  63 <tr><td align="left" valign="top">&bull; <a href="#Introduction" accesskey="1">Introduction</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Overview of pwmd.
  64 </td></tr>
  65 <tr><td align="left" valign="top">&bull; <a href="#Invoking" accesskey="2">Invoking</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Command line options.
  66 </td></tr>
  67 <tr><td align="left" valign="top">&bull; <a href="#Configuration" accesskey="3">Configuration</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Configuration file options.
  68 </td></tr>
  69 <tr><td align="left" valign="top">&bull; <a href="#Commands" accesskey="4">Commands</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Protocol commands.
  70 </td></tr>
  71 <tr><td align="left" valign="top">&bull; <a href="#Status-Messages" accesskey="5">Status Messages</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Status lines and their meaning.
  72 </td></tr>
  73 <tr><td align="left" valign="top">&bull; <a href="#Target-Attribute" accesskey="6">Target Attribute</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">A kind of symbolic link.
  74 </td></tr>
  75 <tr><td align="left" valign="top">&bull; <a href="#Signals" accesskey="7">Signals</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Signals known to pwmd.
  76 </td></tr>
  77 <tr><td align="left" valign="top">&bull; <a href="#Concept-Index" accesskey="8">Concept Index</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Index of concepts.
  78 </td></tr>
  79 </table>
  80
  81 <hr>
  82 <a name="Introduction"></a>
  83 <div class="header">
  84 <p>
  85 Next: <a href="#Invoking" accesskey="n" rel="next">Invoking</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
  86 </div>
  87 <a name="Overview-of-pwmd"></a>
  88 <h2 class="chapter">1 Overview of <code>pwmd</code></h2>
  89
  90
  91
  92
  93
  94
  95 <p><code>pwmd</code> or <em>Password Manager Daemon</em> is a server that
  96 applications connect to and send commands to store and retrieve data
  97 that is saved in an encrypted <abbr>XML</abbr> document.
  98 </p>
  99 <p>The server uses the Assuan protocol (See <a href="http://www.gnupg.org/documentation/manuals/assuan/Implementation.html#Implementation">(assuan)Implementation</a>) which
 100 is the same used by <code>gpg-agent</code>, <code>pinentry</code> and
 101 <code>scdaemon</code>. It also uses <cite>libgpg-error</cite> for error reporting with
 102 the error source set as <var>GPG_ERR_SOURCE_USER_1</var>.
 103 </p>
 104
 105 <p>The <abbr>XML</abbr> document uses the following <abbr>DTD</abbr>:
 106 </p>
 107 <div class="example">
 108 <pre class="example">    &lt;?xml version=&quot;1.0&quot;?&gt;
 109     &lt;!DOCTYPE pwmd [
 110     &lt;!ELEMENT pwmd (element*)&gt;
 111     &lt;!ATTLIST element _name CDATA #REQUIRED&gt;
 112     ]&gt;
 113 </pre></div>
 114
 115 <p>The <code>pwmd</code> element is the document root node while all other elements
 116 of the document have the name <code>element</code> with an attribute <code>_name</code>
 117 whose value uniquely identifies the element at the current element tree depth.
 118 It is done this way to avoid <abbr>XML</abbr> parsing errors for commonly used
 119 characters.  A <abbr>URL</abbr> for example would be an invalid <abbr>XML</abbr> element
 120 since the <abbr>URI</abbr> contains a &lsquo;<samp>:</samp>&rsquo; which is also the <abbr>XML</abbr>
 121 namespace separator.
 122 </p>
 123 <p>As mentioned, an element name must be unique for the current element tree
 124 depth. You cannot have two elements containing the same <code>_name</code> attribute
 125 value. <code>pwmd</code> will stop searching for an element of an <em>element
 126 path</em> at the first match then continue searching for the next element of the
 127 element path beginning at the child node of the matched element.
 128 </p>
 129 <p>An <em>element path</em> is a <tt class="key">TAB</tt> delimited character string where each
 130 <tt class="key">TAB</tt> separates each element in the path.  For example, the element path
 131 <code>a<span class="key">TAB</span>b<span class="key">TAB</span>c</code> has the following <abbr>XML</abbr> document structure:
 132 </p>
 133 <div class="example">
 134 <pre class="example">   &lt;pwmd&gt;
 135             &lt;element _name=&quot;a&quot;&gt;
 136                 &lt;element _name=&quot;b&quot;&gt;
 137                     &lt;element _name=&quot;c&quot;&gt;
 138                         [... element value or content ...]
 139                     &lt;/element&gt;
 140                 &lt;/element&gt;
 141             &lt;/element&gt;
 142         &lt;/pwmd&gt;
 143 </pre></div>
 144
 145 <p>The only restriction of an element name is that it contain no whitespace
 146 characters. It also cannot begin with a &lsquo;<samp>!</samp>&rsquo; since this character is
 147 reserved for the <code>target</code> attribute. See <a href="#Target-Attribute">Target Attribute</a>.
 148 </p>
 149 <hr>
 150 <a name="Invoking"></a>
 151 <div class="header">
 152 <p>
 153 Next: <a href="#Configuration" accesskey="n" rel="next">Configuration</a>, Previous: <a href="#Introduction" accesskey="p" rel="previous">Introduction</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 154 </div>
 155 <a name="Invoking-pwmd"></a>
 156 <h2 class="chapter">2 Invoking <code>pwmd</code></h2>
 157
 158
 159
 160 <p>When <code>pwmd</code> is started with the <samp>--use-agent</samp> command
 161 line option then <code>pwmd</code> will use <code>gpg-agent</code> for key
 162 generation, decryption, signing and caching of passphrases as the
 163 default rather than symmetrically encrypted data files.
 164 <code>gpg-agent</code> must be running prior to <code>pwmd</code> startup when
 165 this option is enabled. The <code>GPG_AGENT_INFO</code> environment variable is
 166 set by <code>gpg-agent</code> and <code>pwmd</code> uses this variable to
 167 determine where the <code>gpg-agent</code> socket is listening for
 168 connections.
 169 </p>
 170 <p>It is recommended to pass the <samp>--allow-preset-passphrase</samp>
 171 command line option to <code>gpg-agent</code>. Doing so allows <code>pwmd</code>
 172 cache pushing on startup. It is also recommended to pass the
 173 <samp>--allow-loopback-pinentry</samp> to <code>gpg-agent</code>. This option allows
 174 a passphrase to be inquired from <code>pwmd</code> when a <code>pinentry</code> is
 175 unavailable to the client.
 176 </p>
 177 <a name="index-Running-pwmd"></a>
 178 <p><code>pwmd</code> is executed as follows:
 179 </p>
 180 <div class="example">
 181 <pre class="example">pwmd <var>options</var> [ file1 ] [ &hellip; ]
 182 </pre></div>
 183
 184 <p>Non-option arguments are data files to cache on startup. When the data file
 185 requires a passphrase for decryption a <code>pinentry</code> will prompt either
 186 on the current <abbr>TTY</abbr> or from an X11 window when the <code>DISPLAY</code>
 187 environment variable is set.
 188 </p>
 189 <a name="index-Options"></a>
 190 <a name="index-Arguments"></a>
 191 <p>The following command line options are supported:
 192 </p>
 193 <a name="index-Getting-help"></a>
 194 <dl compact="compact">
 195 <dt>&lsquo;<samp>--homedir directory</samp>&rsquo;</dt>
 196 <dd><p>The root directory where pwmd will store its data and temporary files.  The
 197 default is <samp>~/.pwmd</samp>.
 198 </p>
 199 </dd>
 200 <dt>&lsquo;<samp>--rcfile, -f rcfile</samp>&rsquo;</dt>
 201 <dd><p>Specify an alternate configuration file. The default is
 202 <samp>~/.pwmd/config</samp>.
 203 </p>
 204 </dd>
 205 <dt>&lsquo;<samp>--use-agent</samp>&rsquo;</dt>
 206 <dd><p>Enable the use of <code>gpg-agent</code> and add support for data files
 207 encrypted with a keypair. Files previously handled by
 208 <code>gpg-agent</code> when this option is not specified will no longer be
 209 able to be opened and new data files are symmetrically or conventionally
 210 encrypted and without a public and private key. If
 211 specified, both data file types are supported.
 212 </p>
 213 </dd>
 214 <dt>&lsquo;<samp>--import, -I filename</samp>&rsquo;</dt>
 215 <dd><p>Imports an <abbr>XML</abbr> file. The <abbr>XML</abbr> file should be in conformance to
 216 the <code>pwmd</code> <abbr>DTD</abbr> (see <a href="#Introduction">Introduction</a>). You
 217 will be prompted for a passphrase to encrypt with.  The output is written to
 218 the filename specified with <samp>--outfile</samp>. To make use of the imported
 219 data, place the output file in <samp>~/.pwmd/data</samp>.
 220 </p>
 221 </dd>
 222 <dt>&lsquo;<samp>--keyparam S-expression</samp>&rsquo;</dt>
 223 <dd><p>The key parameters to use when generating a new key pair while importing an
 224 <abbr>XML</abbr> file or when converting a <em>version 2</em> data file. The argument
 225 must be a valid S-expression (See <a href="http://www.gnupg.org/documentation/manuals/gcrypt/S_002dexpressions.html#S_002dexpressions">(gcrypt)S-expressions</a>).
 226 </p>
 227 </dd>
 228 <dt>&lsquo;<samp>--keygrip hexstring</samp>&rsquo;</dt>
 229 <dd><p>Specifies the hexadecimal encoded public key-grip to use for encryption when
 230 importing or converting. When not specified a new key-pair will be created.
 231 </p>
 232 </dd>
 233 <dt>&lsquo;<samp>--sign-keygrip hexstring</samp>&rsquo;</dt>
 234 <dd><p>Specifies the hexadecimal encoded public key-grip to use for signing of the
 235 data file when importing or converting. When not specified the generated
 236 public key or the key specified with the <samp>--keygrip</samp> option will be
 237 used.
 238 </p>
 239 </dd>
 240 <dt>&lsquo;<samp>--passphrase-file, -k filename&quot;</samp>&rsquo;</dt>
 241 <dd><p>Obtain the passphrase from the specified filename.
 242 </p>
 243 </dd>
 244 <dt>&lsquo;<samp>--s2k-count iterations</samp>&rsquo;</dt>
 245 <dd><p>The number of times to hash the passphrase when importing or converting.  The
 246 default is the gpg-agent calibrated value of the machine. When less than
 247 &lsquo;<samp>65536</samp>&rsquo; the default will be used.
 248 </p>
 249 </dd>
 250 <dt>&lsquo;<samp>--cipher-iterations iterations</samp>&rsquo;</dt>
 251 <dd><p>The number of symmetric encryption iterations. The value is actually N+1. The
 252 default is 0+1.
 253 </p>
 254 </dd>
 255 <dt>&lsquo;<samp>--cipher algo</samp>&rsquo;</dt>
 256 <dd><p>When importing, the cipher to use for data encryption.  See the <var>cipher</var>
 257 configuration parameter (see <a href="#Configuration">Configuration</a>) for available ciphers. The
 258 default is &lsquo;<samp>aes256</samp>&rsquo;.
 259 </p>
 260 </dd>
 261 <dt>&lsquo;<samp>--convert, -C filename</samp>&rsquo;</dt>
 262 <dd><p>Converts a <code>pwmd</code> <em>version 2</em> data file to a <em>version 3</em>
 263 data file. If encrypted, you will be prompted for a passphrase to use for
 264 decryption unless <samp>--passphrase-file</samp> was specified. The converted data
 265 file will be saved to the filename specified with <samp>--outfile</samp>. All
 266 <samp>--import</samp> related options may also be used when converting.
 267 </p>
 268 </dd>
 269 <dt>&lsquo;<samp>--disable-dump, -D</samp>&rsquo;</dt>
 270 <dd><p>Disable the <code>XPATH</code>, <code>XPATHATTR</code>, <code>LIST</code> and <code>DUMP</code>
 271 protocol commands (see <a href="#Commands">Commands</a>). This overrides any
 272 <var>disable_list_and_dump</var> configuration parameter (see <a href="#Configuration">Configuration</a>).
 273 </p>
 274 </dd>
 275 <dt>&lsquo;<samp>--no-fork, -n</samp>&rsquo;</dt>
 276 <dd><p>Run as a foreground process and do not fork into the background.
 277 </p>
 278 </dd>
 279 <dt>&lsquo;<samp>--ignore</samp>&rsquo;</dt>
 280 <dd><p>Ignore cache pushing failures on startup. By default, <code>pwmd</code> will exit
 281 if an error occurred do to an invalid passphrase or other error.
 282 </p>
 283 </dd>
 284 <dt>&lsquo;<samp>--debug-level keyword,keyword,...</samp>&rsquo;</dt>
 285 <dd><p>Output libassuan See <a href="http://www.gnupg.org/documentation/manuals/assuan/index.html#Top">(assuan)Top</a> protocol IO with the comma
 286 separated list of output keywords.  Valid keywords are: <code>init</code>,
 287 <code>ctx</code>, <code>engine</code>, <code>data</code>, <code>sysio</code> and <code>control</code>.
 288 </p>
 289 </dd>
 290 <dt>&lsquo;<samp>--version</samp>&rsquo;</dt>
 291 <dd><p>Show the version, copyright and compile time features and exit.
 292 </p>
 293 </dd>
 294 <dt>&lsquo;<samp>--help</samp>&rsquo;</dt>
 295 <dd><p>Print a summary of options.
 296 </p></dd>
 297 </dl>
 298
 299
 300 <hr>
 301 <a name="Configuration"></a>
 302 <div class="header">
 303 <p>
 304 Next: <a href="#TLS" accesskey="n" rel="next">TLS</a>, Previous: <a href="#Invoking" accesskey="p" rel="previous">Invoking</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 305 </div>
 306 <a name="pwmd-configuration-file-options"></a>
 307 <h2 class="chapter">3 <code>pwmd</code> configuration file options</h2>
 308
 309
 310 <p>If no configuration file is specified with the <code>pwmd</code> <samp>-f</samp>
 311 command line option, <code>pwmd</code> will read <samp>~/.pwmd/config</samp> if it
 312 exists, and if not, will use defaults.  Blank lines and lines beginning with
 313 &lsquo;<samp>#</samp>&rsquo; are ignored. Some parameters may have data file specific settings by
 314 placing them in a file section. A file section is declared by surrounding the
 315 filename with braces (i.e., &lsquo;<samp>[filename]</samp>&rsquo;).  Global options may be
 316 specified in a &lsquo;<samp>[global]</samp>&rsquo; section and are the default options for new or
 317 unspecified files.
 318 </p>
 319 <p>A tilde <tt class="key">~</tt> will be expanded to the home directory of the invoking user
 320 when contained in a parameter whose value is a filename.
 321 </p>
 322 <a name="index-Reloading-the-configuration-file"></a>
 323 <p>The configuration file can be reloaded by sending the <em>SIGHUP</em> signal to
 324 a <code>pwmd</code> process.
 325 </p>
 326 <a name="index-Global-configuration-options"></a>
 327 <p>The following options are only for use in the &lsquo;<samp>global</samp>&rsquo; section:
 328 </p>
 329 <dl compact="compact">
 330 <dt>&lsquo;<samp>socket_path = /path/to/socket</samp>&rsquo;</dt>
 331 <dd><p>Listen on the specified socket. The default is <samp>~/.pwmd/socket</samp>.
 332 </p>
 333 </dd>
 334 <dt>&lsquo;<samp>socket_perms = octal_mode</samp>&rsquo;</dt>
 335 <dd><p>Permissions to set after creating the socket. This will override any
 336 <cite>umask(2)</cite> setting.
 337 </p>
 338 </dd>
 339 <dt>&lsquo;<samp>allowed = [-]user,[-]@group,...</samp>&rsquo;</dt>
 340 <dd><p>A comma separated list of local user names or group names allowed to connect
 341 to the socket. Groups should be prefixed with a &lsquo;<samp>@</samp>&rsquo;. When not specified
 342 only the invoking user may connect. A username or group name may also be
 343 prefixed with a <tt class="key">-</tt> to prevent access to a specific user or group
 344 in the list. The order of the list is important since a user may be of
 345 multiple groups.
 346 </p>
 347 <p>This parameter may also be specified in a filename section to allow or
 348 deny a local user to <code>OPEN</code> (see <a href="#OPEN">OPEN</a>) a data file and has the
 349 same default to allow only the invoking user.
 350 </p>
 351 <p>The following example would deny all users in group <code>primary</code> but
 352 allow <code>username</code> who is a member of <code>primary</code>:
 353 </p>
 354 <div class="example">
 355 <pre class="example">allowed=-@primary,username
 356 </pre></div>
 357
 358 </dd>
 359 <dt>&lsquo;<samp>disable_mlockall = boolean</samp>&rsquo;</dt>
 360 <dd><p>When set to <var>false</var>, <cite>mlockall(2)</cite> will be called on startup.  This
 361 will use more physical memory but may also be more secure since no swapping to
 362 disk will occur. The default is <var>true</var>.
 363 </p>
 364 </dd>
 365 <dt>&lsquo;<samp>log_path = /path/to/logfile</samp>&rsquo;</dt>
 366 <dd><p>Logs informational messages to the specified file. The default is
 367 <samp>~/.pwmd/log</samp>.
 368 </p>
 369 </dd>
 370 <dt>&lsquo;<samp>enable_logging = boolean</samp>&rsquo;</dt>
 371 <dd><p>Enable or disable logging to <var>log_path</var>. The default is <code>false</code>.
 372 </p>
 373 </dd>
 374 <dt>&lsquo;<samp>syslog = boolean</samp>&rsquo;</dt>
 375 <dd><p>Enable logging to <cite>syslog(8)</cite> with facility <em>LOG_DAEMON</em> and priority
 376 <em>LOG_INFO</em>. The default is <code>false</code>.
 377 </p>
 378 </dd>
 379 <dt>&lsquo;<samp>log_level = level</samp>&rsquo;</dt>
 380 <dd><p>When <code>0</code>, only connections and errors are logged. When <code>1</code>, client
 381 commands are also logged. When <code>2</code>, the command arguments are also logged.
 382 The default is <code>0</code>.
 383 </p>
 384 </dd>
 385 <dt>&lsquo;<samp>use_agent = boolean</samp>&rsquo;</dt>
 386 <dd><p>When true, enable <code>gpg-agent</code> support (see <a href="#Invoking">Invoking</a>).
 387 </p>
 388 </dd>
 389 <dt>&lsquo;<samp>agent_env_file = filename</samp>&rsquo;</dt>
 390 <dd><p>A file containing the <code>GPG_AGENT_INFO</code> environment variable and value as
 391 output by the <code>gpg-agent</code> <samp>--write-env-file</samp> command line
 392 option.
 393 </p>
 394 </dd>
 395 <dt>&lsquo;<samp>kill_scd = boolean</samp>&rsquo;</dt>
 396 <dd><p>Kill <code>scdaemon</code> after each <code>OPEN</code> (see <a href="#OPEN">OPEN</a>) or <code>SAVE</code>
 397 (see <a href="#SAVE">SAVE</a>) command.
 398 </p>
 399 </dd>
 400 <dt>&lsquo;<samp>require_save_key = boolean</samp>&rsquo;</dt>
 401 <dd><p>Require the passphrase needed to open a data file before writing changes
 402 of the documment to disk reguardless of the key cache status.
 403 </p>
 404 </dd>
 405 <dt>&lsquo;<samp>disable_list_and_dump = boolean</samp>&rsquo;</dt>
 406 <dd><p>When <code>true</code>, the <code>XPATH</code>, <code>XPATHATTR</code>, <code>LIST</code> and
 407 <code>DUMP</code> protocol commands (see <a href="#Commands">Commands</a>) will be disabled.
 408 </p>
 409 </dd>
 410 <dt>&lsquo;<samp>cache_push = file1,file2</samp>&rsquo;</dt>
 411 <dd><p>A comma separated list of filenames that will be pushed into the file cache
 412 upon startup. <code>pwmd</code> will prompt for the passphrase for each file unless
 413 specified with the <var>passphrase</var> or <var>passphrase_file</var> parameters in a
 414 matching file section.
 415 </p>
 416 </dd>
 417 <dt>&lsquo;<samp>priority = integer</samp>&rsquo;</dt>
 418 <dd><p>The priority, or niceness, of the server. The default is inherited from the
 419 parent process.
 420 </p>
 421 </dd>
 422 <dt>&lsquo;<samp>cipher = algorithm</samp>&rsquo;</dt>
 423 <dd><p>The default cipher to use for data encryption. The algorithm must be one of:
 424 <code>aes128</code>, <code>aes192</code>, <code>aes256</code>, <code>serpent128</code>,
 425 <code>serpent192</code>, <code>serpent256</code>, <code>camellia128</code>,
 426 <code>camellia192</code>, <code>camellia256</code>, <code>3des</code>, <code>cast5</code>,
 427 <code>blowfish</code>, <code>twofish128</code> or <code>twofish256</code>. The default is
 428 <code>aes256</code>.
 429 </p>
 430 </dd>
 431 <dt>&lsquo;<samp>cipher_iterations = integer</samp>&rsquo;</dt>
 432 <dd><p>The number of times to encrypt the XML data. This differs from the
 433 <var>s2k_count</var> parameter which specifies the number of times to hash the
 434 passphrase used to encrypt the data. The default is 0 although 1 iteration is
 435 still done.
 436 </p>
 437 </dd>
 438 <dt>&lsquo;<samp>cipher_progress = integer</samp>&rsquo;</dt>
 439 <dd><p>Send a progress message to the client after the specified amount of encryption
 440 or decryption iterations have been done. The default is 2000.
 441 </p>
 442 </dd>
 443 <dt>&lsquo;<samp>keyparam = s-expression</samp>&rsquo;</dt>
 444 <dd><p>The default key paramaters to use when generating a new key-pair. The
 445 default is RSA with 2048 bits. Note that only RSA as the encryption
 446 algorithm is supported at the moment. Both RSA and DSA keys may be used
 447 for signing.
 448 </p>
 449 </dd>
 450 <dt>&lsquo;<samp>pinentry_path = /path/to/pinentry</samp>&rsquo;</dt>
 451 <dd><p>The location of the <code>pinentry</code> binary. This program is used to
 452 prompt for a passphrase when not using <code>gpg-agent</code>. The default
 453 is specified at compile time.
 454 </p>
 455 </dd>
 456 <dt>&lsquo;<samp>pinentry_timeout = seconds</samp>&rsquo;</dt>
 457 <dd><p>The number of seconds to wait for a pinentry before giving up and
 458 returning an error. This timeout value is used for both waiting for
 459 another pinentry to complete and for the pinentry waiting for user input.
 460 </p></dd>
 461 </dl>
 462
 463 <a name="index-Data-file-configuration-options"></a>
 464 <p>The following options are defaults for new files when specified in the
 465 &lsquo;<samp>global</samp>&rsquo; section. When placed in a data file section they are options
 466 specific to that data file only.
 467 </p>
 468 <dl compact="compact">
 469 <dt>&lsquo;<samp>backup = boolean</samp>&rsquo;</dt>
 470 <dd><p>Whether to create a backup of the data file when saving. The backup filename
 471 has the <samp>.backup</samp> extension appended to the opened file. The default is
 472 <code>true</code>.
 473 </p>
 474 </dd>
 475 <dt>&lsquo;<samp>cache_timeout = seconds</samp>&rsquo;</dt>
 476 <dd><p>The number of seconds to keep the cache entry for this file. If <code>-1</code>, the
 477 cache entry is kept forever. If <code>0</code>, each time an encrypted file is
 478 <code>OPEN</code>ed (see <a href="#OPEN">OPEN</a>) a passphrase will be required. The default
 479 is <code>600</code> or 10 minutes.
 480 </p>
 481 </dd>
 482 <dt>&lsquo;<samp>xfer_progress = bytes</samp>&rsquo;</dt>
 483 <dd><p>Commands that send data lines to the client will also send the <code>XFER</code>
 484 status message (see <a href="#Status-Messages">Status Messages</a>) after the specified number of bytes
 485 have been sent. The number of bytes is rounded to <var>ASSUAN_LINELENGTH</var> or
 486 <code>1002</code> bytes. The default is <code>8196</code>.
 487 </p>
 488 </dd>
 489 <dt>&lsquo;<samp>passphrase = string</samp>&rsquo;</dt>
 490 <dd><p>The passphrase to use for this file. If specified in the &lsquo;<samp>global</samp>&rsquo; section
 491 then &lsquo;<samp>global</samp>&rsquo; is treated as a data filename and not a default for other
 492 files. Note that if a client changes the passphrase for this data file then
 493 this value is not modified and will need to be updated.
 494 </p>
 495 </dd>
 496 <dt>&lsquo;<samp>passphrase_file = /path/to/file</samp>&rsquo;</dt>
 497 <dd><p>Same as the <var>passphrase</var> parameter above but obtains the passphrase from
 498 the specified filename.
 499 </p>
 500 </dd>
 501 <dt>&lsquo;<samp>recursion_depth = integer</samp>&rsquo;</dt>
 502 <dd><p>The maximum number of times to resolve a <code>target</code> attribute for an
 503 element in an element path (see <a href="#Target-Attribute">Target Attribute</a>). An error is returned
 504 when this value is exceeded.  The default is <code>100</code> but can be disabled by
 505 setting to <code>0</code> (<em>not recommended</em>).
 506 </p>
 507 </dd>
 508 <dt>&lsquo;<samp>allowed = [-]user,[-]@group,...</samp>&rsquo;</dt>
 509 <dd><p>Same parameter value as the <code>allowed</code> parameter mentioned above in
 510 the &lsquo;<samp>global</samp>&rsquo; section but grants or denies a local user from opening
 511 a specific data file. The default is to allow only the invoking user.
 512 </p>
 513 </dd>
 514 </dl>
 515 <table class="menu" border="0" cellspacing="0">
 516 <tr><td align="left" valign="top">&bull; <a href="#TLS" accesskey="1">TLS</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Remote connections over TLS.
 517 </td></tr>
 518 <tr><td align="left" valign="top">&bull; <a href="#Pinentry" accesskey="2">Pinentry</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Configuration file and defaults.
 519 </td></tr>
 520 </table>
 521
 522 <hr>
 523 <a name="TLS"></a>
 524 <div class="header">
 525 <p>
 526 Next: <a href="#Pinentry" accesskey="n" rel="next">Pinentry</a>, Previous: <a href="#Configuration" accesskey="p" rel="previous">Configuration</a>, Up: <a href="#Configuration" accesskey="u" rel="up">Configuration</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 527 </div>
 528 <a name="Configuring-remote-connections-over-TLS_002e"></a>
 529 <h2 class="chapter">4 Configuring remote connections over TLS.</h2>
 530 <p>Remote connections can also be made to <code>pwmd</code> over <abbr>TLS</abbr>.
 531 Authentication is done by using X509 client certificates that are signed with
 532 the same Certificate Authority (<abbr>CA</abbr>) as the server certificate.
 533 </p>
 534 <p>The <abbr>CA</abbr> certificate is expected to be found in
 535 <samp>~/.pwmd/ca-cert.pem</samp> while the <code>pwmd</code> server certificate and key
 536 file should be put in <samp>~/.pwmd/server-cert.pem</samp> and
 537 <samp>~/.pwmd/server-key.pem</samp>, respectively.
 538 </p>
 539 <p>See the documentation of <code>certtool</code> or <code>openssl</code> for details
 540 on creating self-signed certificates.
 541 </p>
 542 <p>The following TLS configuration options are available:
 543 </p>
 544 <dl compact="compact">
 545 <dt>&lsquo;<samp>enable_tcp = boolean</samp>&rsquo;</dt>
 546 <dd><p>Whether to enable TCP/TLS server support. If enabled, both TCP and the local
 547 unix domain socket will listen for connections. The default is
 548 <code>false</code>.
 549 </p>
 550 </dd>
 551 <dt>&lsquo;<samp>tcp_port = integer</samp>&rsquo;</dt>
 552 <dd><p>The TCP port to listen on when <var>enable_tcp</var> is <code>true</code>. The default is
 553 <code>6466</code>.
 554 </p>
 555 </dd>
 556 <dt>&lsquo;<samp>tcp_bind = string</samp>&rsquo;</dt>
 557 <dd><p>The internet protocol to listen with. Must be one of <code>ipv4</code>, <code>ipv6</code>
 558 or <code>any</code> to listen for both IPv4 and IPv6 connections.
 559 </p>
 560 </dd>
 561 <dt>&lsquo;<samp>tcp_interface = string</samp>&rsquo;</dt>
 562 <dd><p>Only useful if running as root.
 563 </p>
 564 </dd>
 565 <dt>&lsquo;<samp>tls_timeout = seconds</samp>&rsquo;</dt>
 566 <dd><p>The number of seconds to wait for a read() or write() call on a
 567 <abbr>TLS</abbr> client file descriptor to complete before returning an
 568 error. The default is <var>300</var>.
 569 </p>
 570 <p>Note that the <code>SAVE</code> command (see <a href="#SAVE">SAVE</a>) may take a longer time
 571 to complete than other commands since key generation may need to be done
 572 or do to a large <samp>--cipher-iterations</samp> setting.
 573 </p>
 574 </dd>
 575 <dt>&lsquo;<samp>keepalive_interval = seconds</samp>&rsquo;</dt>
 576 <dd><p>Send a keepalive status message to an idle remote client.  An idle
 577 client is one who is not in a command. The purpose of this status
 578 message is to disconnect a hung remote client and release any file mutex
 579 locks so another client may open the same data file. The default is <code>60</code>.
 580 </p>
 581 </dd>
 582 <dt>&lsquo;<samp>tls_access = string[,string,...]</samp>&rsquo;</dt>
 583 <dd><p>A comma separated list of client X509 certificate fingerprints in SHA-1
 584 format that will be allowed to connect or open a file. If prefixed with
 585 <code>!</code> then access is denied for the fingerprint. When <code>!</code> is
 586 found by itself in the list it is treated as a default for remaining
 587 fingerprints in the list. The <code>+</code> prefix behaves the same but
 588 allows access.
 589 </p>
 590 <p>The access control is two fold: when the client connects its SHA-1
 591 fingerprint is matched against the list of allowed fingerprints in the
 592 &lsquo;<samp>global</samp>&rsquo; section. When allowed in the &lsquo;<samp>global</samp>&rsquo; section the
 593 connection is established and the client may proceed to <code>OPEN</code>
 594 (see <a href="#OPEN">OPEN</a>) a data file. During the <code>OPEN</code> command the
 595 fingerprint is checked again in a &lsquo;<samp>filename</samp>&rsquo; section. When this
 596 parameter is not found in a &lsquo;<samp>filename</samp>&rsquo; section then access is granted.
 597 </p>
 598 </dd>
 599 <dt>&lsquo;<samp>tcp_require_key = boolean</samp>&rsquo;</dt>
 600 <dd><p>When <code>true</code>, require the remote client to provide the key or passphrase
 601 to open a data file even if the file is cached. Note that the cache entry is
 602 cleared during the see <a href="#OPEN">OPEN</a> command and the passphrase will be retrieved
 603 from the client via a server <em>INQUIRE</em>. This option is a default
 604 for all files when specified in the &lsquo;<samp>global</samp>&rsquo; section. The default
 605 is <code>false</code>.
 606 </p>
 607 </dd>
 608 <dt>&lsquo;<samp>tcp_wait = integer</samp>&rsquo;</dt>
 609 <dd><p>The time in tenths of a second to wait between TCP connections.  Setting to 0
 610 will disable waiting. The default is <code>3</code>.
 611 </p>
 612 </dd>
 613 <dt>&lsquo;<samp>tls_cipher_suite = string</samp>&rsquo;</dt>
 614 <dd><p>The GnuTLS cipher suite and protocol to use. See the GnuTLS documentation for
 615 information about the format of this string. The default is <code>SECURE256</code>.
 616 </p></dd>
 617 </dl>
 618
 619 <hr>
 620 <a name="Pinentry"></a>
 621 <div class="header">
 622 <p>
 623 Next: <a href="#Commands" accesskey="n" rel="next">Commands</a>, Previous: <a href="#TLS" accesskey="p" rel="previous">TLS</a>, Up: <a href="#Configuration" accesskey="u" rel="up">Configuration</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 624 </div>
 625 <a name="Pinentry-configuration"></a>
 626 <h2 class="chapter">5 Pinentry configuration</h2>
 627
 628 <p>The <code>pinentry</code> program is used to prompt the user for passphrase
 629 input or as a confirmation dialog; it needs to know where to prompt for
 630 the input, beit from a terminal or an X11 display.
 631 </p>
 632 <p>It is the responsibility of the client to tell <code>pinentry</code> about
 633 the terminal or X11 display before requiring the input. This is done by
 634 using the <code>pwmd</code> see <a href="#OPTION">OPTION</a> protocol command. It need be
 635 done only once per client connection. To avoid the use of
 636 <code>pinentry</code> entirely, use the <code>OPTION</code> (see <a href="#OPTION">OPTION</a>)
 637 <samp>--disable-pinentry</samp> protocol command.
 638 </p>
 639 <hr>
 640 <a name="Commands"></a>
 641 <div class="header">
 642 <p>
 643 Next: <a href="#Status-Messages" accesskey="n" rel="next">Status Messages</a>, Previous: <a href="#Pinentry" accesskey="p" rel="previous">Pinentry</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 644 </div>
 645 <a name="Protocol-commands-and-their-syntax"></a>
 646 <h2 class="chapter">6 Protocol commands and their syntax</h2>
 647 <table class="menu" border="0" cellspacing="0">
 648 <tr><td align="left" valign="top">&bull; <a href="#AGENT" accesskey="1">AGENT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 649 </td></tr>
 650 <tr><td align="left" valign="top">&bull; <a href="#ATTR" accesskey="2">ATTR</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 651 </td></tr>
 652 <tr><td align="left" valign="top">&bull; <a href="#CACHETIMEOUT" accesskey="3">CACHETIMEOUT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 653 </td></tr>
 654 <tr><td align="left" valign="top">&bull; <a href="#CLEARCACHE" accesskey="4">CLEARCACHE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 655 </td></tr>
 656 <tr><td align="left" valign="top">&bull; <a href="#COPY" accesskey="5">COPY</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 657 </td></tr>
 658 <tr><td align="left" valign="top">&bull; <a href="#DELETE" accesskey="6">DELETE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 659 </td></tr>
 660 <tr><td align="left" valign="top">&bull; <a href="#DUMP" accesskey="7">DUMP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 661 </td></tr>
 662 <tr><td align="left" valign="top">&bull; <a href="#GET" accesskey="8">GET</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 663 </td></tr>
 664 <tr><td align="left" valign="top">&bull; <a href="#GETCONFIG" accesskey="9">GETCONFIG</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 665 </td></tr>
 666 <tr><td align="left" valign="top">&bull; <a href="#GETINFO">GETINFO</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 667 </td></tr>
 668 <tr><td align="left" valign="top">&bull; <a href="#HELP">HELP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 669 </td></tr>
 670 <tr><td align="left" valign="top">&bull; <a href="#IMPORT">IMPORT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 671 </td></tr>
 672 <tr><td align="left" valign="top">&bull; <a href="#ISCACHED">ISCACHED</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 673 </td></tr>
 674 <tr><td align="left" valign="top">&bull; <a href="#KEYGRIP">KEYGRIP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 675 </td></tr>
 676 <tr><td align="left" valign="top">&bull; <a href="#LIST">LIST</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 677 </td></tr>
 678 <tr><td align="left" valign="top">&bull; <a href="#LOCK">LOCK</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 679 </td></tr>
 680 <tr><td align="left" valign="top">&bull; <a href="#LS">LS</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 681 </td></tr>
 682 <tr><td align="left" valign="top">&bull; <a href="#MOVE">MOVE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 683 </td></tr>
 684 <tr><td align="left" valign="top">&bull; <a href="#NOP">NOP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 685 </td></tr>
 686 <tr><td align="left" valign="top">&bull; <a href="#OPEN">OPEN</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 687 </td></tr>
 688 <tr><td align="left" valign="top">&bull; <a href="#OPTION">OPTION</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 689 </td></tr>
 690 <tr><td align="left" valign="top">&bull; <a href="#PASSWD">PASSWD</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 691 </td></tr>
 692 <tr><td align="left" valign="top">&bull; <a href="#REALPATH">REALPATH</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 693 </td></tr>
 694 <tr><td align="left" valign="top">&bull; <a href="#RENAME">RENAME</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 695 </td></tr>
 696 <tr><td align="left" valign="top">&bull; <a href="#RESET">RESET</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 697 </td></tr>
 698 <tr><td align="left" valign="top">&bull; <a href="#SAVE">SAVE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 699 </td></tr>
 700 <tr><td align="left" valign="top">&bull; <a href="#STORE">STORE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 701 </td></tr>
 702 <tr><td align="left" valign="top">&bull; <a href="#UNLOCK">UNLOCK</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 703 </td></tr>
 704 <tr><td align="left" valign="top">&bull; <a href="#XPATH">XPATH</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 705 </td></tr>
 706 <tr><td align="left" valign="top">&bull; <a href="#XPATHATTR">XPATHATTR</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 707 </td></tr>
 708 </table>
 709 <hr>
 710 <a name="AGENT"></a>
 711 <div class="header">
 712 <p>
 713 Next: <a href="#ATTR" accesskey="n" rel="next">ATTR</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 714 </div>
 715 <a name="AGENT-command"></a>
 716 <h2 class="chapter">7 AGENT command</h2>
 717 <a name="index-AGENT-command"></a>
 718 <p>Syntax:
 719 </p><div class="example">
 720 <pre class="example">AGENT &lt;command&gt;
 721 </pre></div>
 722
 723 <p>Send a <code>gpg-agent</code> protocol <var>command</var> directly to the
 724 <code>gpg-agent</code>.
 725 </p>
 726
 727 <hr>
 728 <a name="ATTR"></a>
 729 <div class="header">
 730 <p>
 731 Next: <a href="#CACHETIMEOUT" accesskey="n" rel="next">CACHETIMEOUT</a>, Previous: <a href="#AGENT" accesskey="p" rel="previous">AGENT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 732 </div>
 733 <a name="ATTR-command"></a>
 734 <h2 class="chapter">8 ATTR command</h2>
 735 <a name="index-ATTR-command"></a>
 736 <p>Syntax:
 737 </p><div class="example">
 738 <pre class="example">ATTR [--inquire] SET|GET|DELETE|LIST [&lt;attribute&gt;] [!]element[&lt;TAB&gt;[!]child[..]] ..
 739 </pre></div>
 740
 741 <dl compact="compact">
 742 <dt>ATTR SET attribute [!]element[&lt;TAB&gt;[!]child[..]] [value]</dt>
 743 <dd>
 744 <p>Stores or updates an <var>attribute</var> name and optional <var>value</var> of an
 745 element. When no <var>value</var> is specified any existing value will be removed.
 746 </p>
 747 </dd>
 748 <dt>ATTR DELETE attribute [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 749 <dd>
 750 <p>Removes an <var>attribute</var> from an element.
 751 </p>
 752 </dd>
 753 <dt>ATTR LIST [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 754 <dd>
 755 <p>Retrieves a newline separated list of attributes names and values
 756 from the specified element. Each attribute name and value is space delimited.
 757 </p>
 758 </dd>
 759 <dt>ATTR GET attribute [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 760 <dd>
 761 <p>Retrieves the value of an <var>attribute</var> from an element.
 762 </p></dd>
 763 </dl>
 764
 765 <p>The <code>_name</code> attribute (case sensitive) cannot be removed nor modified.
 766 Use the <code>DELETE</code> (see <a href="#DELETE">DELETE</a>) or <code>RENAME</code> (see <a href="#RENAME">RENAME</a>)
 767 commands instead.
 768 </p>
 769 <p>The <code>_mtime</code> attribute is updated each time an element is modified by
 770 either storing content, editing attributes or by deleting a child element.
 771 The <code>_ctime</code> attribute is created for each new element in an element
 772 path.
 773 </p>
 774 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 775 arguments are retrieved via a server <em>INQUIRE</em>.
 776 </p>
 777 <p>See <a href="#Target-Attribute">Target Attribute</a>, for details about this special attribute.
 778 </p>
 779
 780 <hr>
 781 <a name="CACHETIMEOUT"></a>
 782 <div class="header">
 783 <p>
 784 Next: <a href="#CLEARCACHE" accesskey="n" rel="next">CLEARCACHE</a>, Previous: <a href="#ATTR" accesskey="p" rel="previous">ATTR</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 785 </div>
 786 <a name="CACHETIMEOUT-command"></a>
 787 <h2 class="chapter">9 CACHETIMEOUT command</h2>
 788 <a name="index-CACHETIMEOUT-command"></a>
 789 <p>Syntax:
 790 </p><div class="example">
 791 <pre class="example">CACHETIMEOUT &lt;filename&gt; &lt;seconds&gt;
 792 </pre></div>
 793
 794 <p>The time in <var>seconds</var> until <var>filename</var> will be removed from the
 795 cache. <code>-1</code> will keep the cache entry forever, <code>0</code> will require
 796 the passphrase for each <code>OPEN</code> or <code>SAVE</code> command (see <a href="#OPEN">OPEN</a>,
 797 see <a href="#SAVE">SAVE</a>). See <a href="#Configuration">Configuration</a>, and the <code>cache_timeout</code>
 798 parameter.
 799 </p>
 800
 801 <hr>
 802 <a name="CLEARCACHE"></a>
 803 <div class="header">
 804 <p>
 805 Next: <a href="#COPY" accesskey="n" rel="next">COPY</a>, Previous: <a href="#CACHETIMEOUT" accesskey="p" rel="previous">CACHETIMEOUT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 806 </div>
 807 <a name="CLEARCACHE-command"></a>
 808 <h2 class="chapter">10 CLEARCACHE command</h2>
 809 <a name="index-CLEARCACHE-command"></a>
 810 <p>Syntax:
 811 </p><div class="example">
 812 <pre class="example">CLEARCACHE [&lt;filename&gt;]
 813 </pre></div>
 814
 815 <p>Clears a file cache entry for all or the specified <var>filename</var>.
 816 </p>
 817
 818 <hr>
 819 <a name="COPY"></a>
 820 <div class="header">
 821 <p>
 822 Next: <a href="#DELETE" accesskey="n" rel="next">DELETE</a>, Previous: <a href="#CLEARCACHE" accesskey="p" rel="previous">CLEARCACHE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 823 </div>
 824 <a name="COPY-command"></a>
 825 <h2 class="chapter">11 COPY command</h2>
 826 <a name="index-COPY-command"></a>
 827 <p>Syntax:
 828 </p><div class="example">
 829 <pre class="example">COPY [--inquire] [!]source[&lt;TAB&gt;[!]child[..]] [!]dest[&lt;TAB&gt;[!]child[..]]
 830 </pre></div>
 831
 832 <p>Copies the entire element tree starting from the child node of the source
 833 element, to the destination element path. If the destination element path
 834 does not exist then it will be created; otherwise it is overwritten.
 835 </p>
 836 <p>Note that attributes from the source element are merged into the
 837 destination element when the destination element path exists. When an
 838 attribute of the same name exists in both the source and destination
 839 elements then the destination attribute will be updated to the source
 840 attribute value.
 841 </p>
 842 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 843 arguments are retrieved via a server <em>INQUIRE</em>.
 844 </p>
 845
 846 <hr>
 847 <a name="DELETE"></a>
 848 <div class="header">
 849 <p>
 850 Next: <a href="#DUMP" accesskey="n" rel="next">DUMP</a>, Previous: <a href="#COPY" accesskey="p" rel="previous">COPY</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 851 </div>
 852 <a name="DELETE-command"></a>
 853 <h2 class="chapter">12 DELETE command</h2>
 854 <a name="index-DELETE-command"></a>
 855 <p>Syntax:
 856 </p><div class="example">
 857 <pre class="example">DELETE [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
 858 </pre></div>
 859
 860 <p>Removes the specified element path and all of its children. This may break
 861 an element with a <code>target</code> attribute (see <a href="#Target-Attribute">Target Attribute</a>) that
 862 refers to this element or any of its children.
 863 </p>
 864 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 865 arguments are retrieved via a server <em>INQUIRE</em>.
 866 </p>
 867
 868 <hr>
 869 <a name="DUMP"></a>
 870 <div class="header">
 871 <p>
 872 Next: <a href="#GET" accesskey="n" rel="next">GET</a>, Previous: <a href="#DELETE" accesskey="p" rel="previous">DELETE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 873 </div>
 874 <a name="DUMP-command"></a>
 875 <h2 class="chapter">13 DUMP command</h2>
 876 <a name="index-DUMP-command"></a>
 877 <p>Syntax:
 878 </p><div class="example">
 879 <pre class="example">DUMP
 880 </pre></div>
 881
 882 <p>Shows the in memory <abbr>XML</abbr> document with indenting. See <a href="#XPATH">XPATH</a>, for
 883 dumping a specific node.
 884 </p>
 885
 886 <hr>
 887 <a name="GET"></a>
 888 <div class="header">
 889 <p>
 890 Next: <a href="#GETCONFIG" accesskey="n" rel="next">GETCONFIG</a>, Previous: <a href="#DUMP" accesskey="p" rel="previous">DUMP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 891 </div>
 892 <a name="GET-command"></a>
 893 <h2 class="chapter">14 GET command</h2>
 894 <a name="index-GET-command"></a>
 895 <p>Syntax:
 896 </p><div class="example">
 897 <pre class="example">GET [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
 898 </pre></div>
 899
 900 <p>Retrieves the content of the specified element. The content is returned
 901 with a data response.
 902 </p>
 903 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 904 arguments are retrieved via a server <em>INQUIRE</em>.
 905 </p>
 906
 907 <hr>
 908 <a name="GETCONFIG"></a>
 909 <div class="header">
 910 <p>
 911 Next: <a href="#GETINFO" accesskey="n" rel="next">GETINFO</a>, Previous: <a href="#GET" accesskey="p" rel="previous">GET</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 912 </div>
 913 <a name="GETCONFIG-command"></a>
 914 <h2 class="chapter">15 GETCONFIG command</h2>
 915 <a name="index-GETCONFIG-command"></a>
 916 <p>Syntax:
 917 </p><div class="example">
 918 <pre class="example">GETCONFIG [filename] &lt;parameter&gt;
 919 </pre></div>
 920
 921 <p>Returns the value of a <code>pwmd</code> configuration <var>parameter</var> with a
 922 data response. If no file has been opened then the value for <var>filename</var>
 923 or the default from the &lsquo;<samp>global</samp>&rsquo; section will be returned. If a file
 924 has been opened and no <var>filename</var> is specified, a value previously
 925 set with the <code>OPTION</code> command (see <a href="#OPTION">OPTION</a>) will be returned.
 926 </p>
 927
 928 <hr>
 929 <a name="GETINFO"></a>
 930 <div class="header">
 931 <p>
 932 Next: <a href="#HELP" accesskey="n" rel="next">HELP</a>, Previous: <a href="#GETCONFIG" accesskey="p" rel="previous">GETCONFIG</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 933 </div>
 934 <a name="GETINFO-command"></a>
 935 <h2 class="chapter">16 GETINFO command</h2>
 936 <a name="index-GETINFO-command"></a>
 937 <p>Syntax:
 938 </p><div class="example">
 939 <pre class="example">GETINFO [--data] CACHE | CLIENTS | PID | LAST_ERROR | VERSION
 940 </pre></div>
 941
 942 <p>Get server and other information: <var>cache</var> returns the number of cached
 943 documents via a status message. <var>clients</var> returns the number of
 944 connected clients via a status message. <var>pid</var> returns the process ID
 945 number of the server via a data response. <var>VERSION</var> returns the server
 946 version number and compile-time features with a data response with each
 947 being space delimited. <var>LAST_ERROR</var> returns a detailed description of
 948 the last failed command when available. See <a href="#Status-Messages">Status Messages</a>.
 949 </p>
 950 <p>When the <samp>--data</samp> option is specified then the result will be sent
 951 via a data response rather than a status message.
 952 </p>
 953
 954 <hr>
 955 <a name="HELP"></a>
 956 <div class="header">
 957 <p>
 958 Next: <a href="#IMPORT" accesskey="n" rel="next">IMPORT</a>, Previous: <a href="#GETINFO" accesskey="p" rel="previous">GETINFO</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 959 </div>
 960 <a name="HELP-command"></a>
 961 <h2 class="chapter">17 HELP command</h2>
 962 <a name="index-HELP-command"></a>
 963 <p>Syntax:
 964 </p><div class="example">
 965 <pre class="example">HELP [&lt;COMMAND&gt;]
 966 </pre></div>
 967
 968 <p>Show available commands or command specific help text.
 969 </p>
 970
 971 <hr>
 972 <a name="IMPORT"></a>
 973 <div class="header">
 974 <p>
 975 Next: <a href="#ISCACHED" accesskey="n" rel="next">ISCACHED</a>, Previous: <a href="#HELP" accesskey="p" rel="previous">HELP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 976 </div>
 977 <a name="IMPORT-command"></a>
 978 <h2 class="chapter">18 IMPORT command</h2>
 979 <a name="index-IMPORT-command"></a>
 980 <p>Syntax:
 981 </p><div class="example">
 982 <pre class="example">IMPORT [--root [!]element[&lt;TAB&gt;[!]child[..]]] &lt;content&gt;
 983 </pre></div>
 984
 985 <p>This command uses a server <em>INQUIRE</em> to retrieve data from the client.
 986 </p>
 987 <p>Like the <code>STORE</code> command (see <a href="#STORE">STORE</a>), but the <var>content</var>
 988 argument is raw <abbr>XML</abbr> data. The content is created as a child of
 989 the element path specified with the <samp>--root</samp> option or at the
 990 document root when not specified. Existing elements of the same name will
 991 be overwritten.
 992 </p>
 993 <p>The content must begin with an <abbr>XML</abbr> element node. See <a href="#Introduction">Introduction</a>,
 994 for details.
 995 </p>
 996
 997 <hr>
 998 <a name="ISCACHED"></a>
 999 <div class="header">
1000 <p>
1001 Next: <a href="#KEYGRIP" accesskey="n" rel="next">KEYGRIP</a>, Previous: <a href="#IMPORT" accesskey="p" rel="previous">IMPORT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1002 </div>
1003 <a name="ISCACHED-command"></a>
1004 <h2 class="chapter">19 ISCACHED command</h2>
1005 <a name="index-ISCACHED-command"></a>
1006 <p>Syntax:
1007 </p><div class="example">
1008 <pre class="example">ISCACHED [--lock] &lt;filename&gt;
1009 </pre></div>
1010
1011 <p>An <em>OK</em> response is returned if the specified <var>filename</var> is found
1012 in the file cache. If not found in the cache but exists on the filesystem
1013 then <var>GPG_ERR_NO_DATA</var> is returned. Otherwise a filesystem error is
1014 returned.
1015 </p>
1016 <p>The <samp>lock</samp> option will lock the file mutex of <var>filename</var> when the
1017 file exists; it does not need to be opened nor cached.
1018 </p>
1019
1020 <hr>
1021 <a name="KEYGRIP"></a>
1022 <div class="header">
1023 <p>
1024 Next: <a href="#LIST" accesskey="n" rel="next">LIST</a>, Previous: <a href="#ISCACHED" accesskey="p" rel="previous">ISCACHED</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1025 </div>
1026 <a name="KEYGRIP-command"></a>
1027 <h2 class="chapter">20 KEYGRIP command</h2>
1028 <a name="index-KEYGRIP-command"></a>
1029 <p>Syntax:
1030 </p><div class="example">
1031 <pre class="example">KEYGRIP [--sign] &lt;filename&gt;
1032 </pre></div>
1033
1034 <p>Returns the hex encoded keygrip of the specified <var>filename</var> with a
1035 data response.
1036 </p>
1037 <p>When the <samp>--sign</samp> option is specified then the key used for signing
1038 of the specified <var>filename</var> will be returned.
1039 </p>
1040 <p>For symmetrically encrypted data files this command returns the error
1041 GPG_ERR_NOT_SUPPORTED.
1042 </p>
1043
1044 <hr>
1045 <a name="LIST"></a>
1046 <div class="header">
1047 <p>
1048 Next: <a href="#LOCK" accesskey="n" rel="next">LOCK</a>, Previous: <a href="#KEYGRIP" accesskey="p" rel="previous">KEYGRIP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1049 </div>
1050 <a name="LIST-command"></a>
1051 <h2 class="chapter">21 LIST command</h2>
1052 <a name="index-LIST-command"></a>
1053 <p>Syntax:
1054 </p><div class="example">
1055 <pre class="example">LIST [--inquire] [--no-recurse] [--verbose] [--with-target] [--all] [[!]element[&lt;TAB&gt;[!]child[..]]]
1056 </pre></div>
1057
1058 <p>If no element path is given then a newline separated list of root elements
1059 is returned with a data response. If given, then all reachable elements
1060 of the specified element path are returned unless the <samp>--no-recurse</samp>
1061 option is specified. If specified, only the child elements of the element
1062 path are returned without recursing into grandchildren. Each resulting
1063 element is prefixed with the literal <code>!</code> character when the element
1064 contains no <code>target</code> attribute. See <a href="#Target-Attribute">Target Attribute</a>, for details.
1065 </p>
1066 <p>When the <samp>--verbose</samp> option is passed then each element path
1067 returned will have zero or more flags appened to it. These flags are
1068 delimited from the element path by a single space character. A flag itself
1069 is a single character. Flag <code>+</code> indicates that there are child nodes of
1070 the current element path. Flag <code>E</code> indicates that an element of an
1071 element path contained in a <var>target</var> attribute could not be found. Flag
1072 <code>O</code> indicates that a <var>target</var> attribute recursion limit was reached
1073 (see <a href="#Configuration">Configuration</a>). Flag <code>T</code> will append the resolved element path
1074 of the <var>target</var> attribute contained in the current element (see below).
1075 </p>
1076 <p>The <samp>--with-target</samp> option implies <samp>--verbose</samp> and will append
1077 an additional flag <code>T</code> followed by a single space then an element path.
1078 The appended element path is the resolved path (see <a href="#REALPATH">REALPATH</a>) of the
1079 current element when it contains a <var>target</var> attribute. When no
1080 <var>target</var> attribute is found then no flag will be appended.
1081 </p>
1082 <p>The <samp>--no-recurse</samp> option limits the amount of data returned to only
1083 the listing of children of the specified element path and not any
1084 grandchildren.
1085 </p>
1086 <p>The <samp>--all</samp> option lists the entire element tree for each root
1087 element. This option also implies option <samp>--verbose</samp>.
1088 </p>
1089 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1090 arguments are retrieved via a server <em>INQUIRE</em>.
1091 </p>
1092
1093 <hr>
1094 <a name="LOCK"></a>
1095 <div class="header">
1096 <p>
1097 Next: <a href="#LS" accesskey="n" rel="next">LS</a>, Previous: <a href="#LIST" accesskey="p" rel="previous">LIST</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1098 </div>
1099 <a name="LOCK-command"></a>
1100 <h2 class="chapter">22 LOCK command</h2>
1101 <a name="index-LOCK-command"></a>
1102 <p>Syntax:
1103 </p><div class="example">
1104 <pre class="example">LOCK
1105 </pre></div>
1106
1107 <p>Locks the mutex associated with the opened file. This prevents other clients
1108 from sending commands to the same opened file until the client
1109 that sent this command either disconnects or sends the <code>UNLOCK</code>
1110 command. See <a href="#UNLOCK">UNLOCK</a>.
1111 </p>
1112
1113 <hr>
1114 <a name="LS"></a>
1115 <div class="header">
1116 <p>
1117 Next: <a href="#MOVE" accesskey="n" rel="next">MOVE</a>, Previous: <a href="#LOCK" accesskey="p" rel="previous">LOCK</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1118 </div>
1119 <a name="LS-command"></a>
1120 <h2 class="chapter">23 LS command</h2>
1121 <a name="index-LS-command"></a>
1122 <p>Syntax:
1123 </p><div class="example">
1124 <pre class="example">LS
1125 </pre></div>
1126
1127 <p>Lists the available data files stored in the data directory
1128 (<samp>~/.pwmd/data</samp>). The result is a newline separated list of filenames.
1129 </p>
1130
1131 <hr>
1132 <a name="MOVE"></a>
1133 <div class="header">
1134 <p>
1135 Next: <a href="#NOP" accesskey="n" rel="next">NOP</a>, Previous: <a href="#LS" accesskey="p" rel="previous">LS</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1136 </div>
1137 <a name="MOVE-command"></a>
1138 <h2 class="chapter">24 MOVE command</h2>
1139 <a name="index-MOVE-command"></a>
1140 <p>Syntax:
1141 </p><div class="example">
1142 <pre class="example">MOVE [--inquire] [!]source[&lt;TAB&gt;[!]child[..]] [[!]dest[&lt;TAB&gt;[!]child[..]]]
1143 </pre></div>
1144
1145 <p>Moves the source element path to the destination element path. If the
1146 destination is not specified then it will be moved to the root node of the
1147 document. If the destination is specified and exists then it will be
1148 overwritten; otherwise non-existing elements of the destination element
1149 path will be created.
1150 </p>
1151 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1152 arguments are retrieved via a server <em>INQUIRE</em>.
1153 </p>
1154
1155 <hr>
1156 <a name="NOP"></a>
1157 <div class="header">
1158 <p>
1159 Next: <a href="#OPEN" accesskey="n" rel="next">OPEN</a>, Previous: <a href="#MOVE" accesskey="p" rel="previous">MOVE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1160 </div>
1161 <a name="NOP-command"></a>
1162 <h2 class="chapter">25 NOP command</h2>
1163 <a name="index-NOP-command"></a>
1164 <p>Syntax:
1165 </p><div class="example">
1166 <pre class="example">NOP
1167 </pre></div>
1168
1169 <p>Does nothing. Always returns successfully.
1170 </p>
1171
1172 <hr>
1173 <a name="OPEN"></a>
1174 <div class="header">
1175 <p>
1176 Next: <a href="#OPTION" accesskey="n" rel="next">OPTION</a>, Previous: <a href="#NOP" accesskey="p" rel="previous">NOP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1177 </div>
1178 <a name="OPEN-command"></a>
1179 <h2 class="chapter">26 OPEN command</h2>
1180 <a name="index-OPEN-command"></a>
1181 <p>Syntax:
1182 </p><div class="example">
1183 <pre class="example">OPEN [--lock] &lt;filename&gt; [&lt;passphrase&gt;]
1184 </pre></div>
1185
1186 <p>Opens <var>filename</var> using <var>passphrase</var>. When the filename is not
1187 found on the file-system  then a new document will be created. If the file
1188 is found, it is looked for in the file cache. If cached and no
1189 <var>passphrase</var> was specified then the cached document is opened. When not
1190 cached, <cite>pinentry(1)</cite> will be used to retrieve the passphrase to use
1191 for decryption unless <samp>disable-pinentry</samp> (see <a href="#OPTION">OPTION</a>) was
1192 specified.
1193 </p>
1194 <p>When the <samp>--lock</samp> option is passed then the file mutex will be
1195 locked as if the <code>LOCK</code> command (see <a href="#LOCK">LOCK</a>) had been sent after the
1196 file has been opened.
1197 </p>
1198
1199 <hr>
1200 <a name="OPTION"></a>
1201 <div class="header">
1202 <p>
1203 Next: <a href="#PASSWD" accesskey="n" rel="next">PASSWD</a>, Previous: <a href="#OPEN" accesskey="p" rel="previous">OPEN</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1204 </div>
1205 <a name="OPTION-command"></a>
1206 <h2 class="chapter">27 OPTION command</h2>
1207 <a name="index-OPTION-command"></a>
1208 <p>Syntax:
1209 </p><div class="example">
1210 <pre class="example">OPTION &lt;NAME&gt;=&lt;VALUE&gt;
1211 </pre></div>
1212
1213 <p>Sets a client option <var>name</var> to <var>value</var>. The value for an option is
1214 kept for the duration of the connection.
1215 </p>
1216 <dl compact="compact">
1217 <dt>DISABLE-PINENTRY</dt>
1218 <dd><p>Disable use of <code>pinentry</code> for passphrase retrieval. When set, a
1219 server inquire is sent to the client to obtain the passphrase. This option
1220 may be set as needed before the see <a href="#OPEN">OPEN</a>, see <a href="#PASSWD">PASSWD</a>, and
1221 see <a href="#SAVE">SAVE</a> commands.
1222 </p>
1223 </dd>
1224 <dt>PINENTRY-TIMEOUT</dt>
1225 <dd><p>Sets the number of seconds before a pinentry prompt will return an error
1226 while waiting for user input.
1227 </p>
1228 </dd>
1229 <dt>TTYNAME</dt>
1230 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1231 </p>
1232 </dd>
1233 <dt>TTYTYPE</dt>
1234 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1235 </p>
1236 </dd>
1237 <dt>DISPLAY</dt>
1238 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1239 </p>
1240 </dd>
1241 <dt>PINENTRY-DESC</dt>
1242 <dd><p>Sets the description string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1243 </p>
1244 </dd>
1245 <dt>PINENTRY-TITLE</dt>
1246 <dd><p>Sets the title string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1247 </p>
1248 </dd>
1249 <dt>PINENTRY-PROMPT</dt>
1250 <dd><p>Sets the prompt string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1251 </p>
1252 </dd>
1253 <dt>LC-CTYPE</dt>
1254 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1255 </p>
1256 </dd>
1257 <dt>LC-MESSAGES</dt>
1258 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1259 </p>
1260 </dd>
1261 <dt>NAME</dt>
1262 <dd><p>Associates the thread ID of the connection with the specified textual
1263 representation. Useful for debugging log messages.
1264 </p>
1265 </dd>
1266 <dt>LOCK-TIMEOUT</dt>
1267 <dd><p>When not <code>0</code>, the duration in tenths of a second to wait for the file
1268 mutex which has been locked by another thread to be released before returning
1269 an error. When <code>-1</code>, then an error will be returned immediately.
1270 </p>
1271 </dd>
1272 <dt>LOG-LEVEL</dt>
1273 <dd><p>An integer specifiying the logging level.
1274 </p></dd>
1275 </dl>
1276
1277
1278 <hr>
1279 <a name="PASSWD"></a>
1280 <div class="header">
1281 <p>
1282 Next: <a href="#REALPATH" accesskey="n" rel="next">REALPATH</a>, Previous: <a href="#OPTION" accesskey="p" rel="previous">OPTION</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1283 </div>
1284 <a name="PASSWD-command"></a>
1285 <h2 class="chapter">28 PASSWD command</h2>
1286 <a name="index-PASSWD-command"></a>
1287 <p>Syntax:
1288 </p><div class="example">
1289 <pre class="example">PASSWD [--reset] [--s2k-count=N] [--no-passphrase]
1290 </pre></div>
1291
1292 <p>Changes the passphrase of the secret key required to open the current
1293 file or the passphrase of a symmetrically encrypted data file. When the
1294 <samp>--reset</samp> option is passed then the cache entry for the current
1295 file will be reset and the passphrase, if any, will be required during the
1296 next <code>OPEN</code>. See <a href="#OPEN">OPEN</a>.
1297 </p>
1298 <p>The <samp>--s2k-count</samp> option sets number of hash iterations for a
1299 passphrase and must be either <code>0</code> to use the calibrated count of the
1300 machine (the default), or a value greater than or equal to <code>65536</code>.
1301 See <a href="#SAVE">SAVE</a>. This option has no effect for symmetrically encrypted data
1302 files.
1303 </p>
1304 <p>The <samp>--no-passphrase</samp> option will prevent requiring a passphrase for
1305 the data file, although a passphrase may be required when changing it.
1306 </p>
1307
1308 <hr>
1309 <a name="REALPATH"></a>
1310 <div class="header">
1311 <p>
1312 Next: <a href="#RENAME" accesskey="n" rel="next">RENAME</a>, Previous: <a href="#PASSWD" accesskey="p" rel="previous">PASSWD</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1313 </div>
1314 <a name="REALPATH-command"></a>
1315 <h2 class="chapter">29 REALPATH command</h2>
1316 <a name="index-REALPATH-command"></a>
1317 <p>Syntax:
1318 </p><div class="example">
1319 <pre class="example">REALPATH [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
1320 </pre></div>
1321
1322 <p>Resolves all <code>target</code> attributes of the specified element path and
1323 returns the result with a data response. See <a href="#Target-Attribute">Target Attribute</a>, for details.
1324 </p>
1325 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1326 arguments are retrieved via a server <em>INQUIRE</em>.
1327 </p>
1328
1329 <hr>
1330 <a name="RENAME"></a>
1331 <div class="header">
1332 <p>
1333 Next: <a href="#RESET" accesskey="n" rel="next">RESET</a>, Previous: <a href="#REALPATH" accesskey="p" rel="previous">REALPATH</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1334 </div>
1335 <a name="RENAME-command"></a>
1336 <h2 class="chapter">30 RENAME command</h2>
1337 <a name="index-RENAME-command"></a>
1338 <p>Syntax:
1339 </p><div class="example">
1340 <pre class="example">RENAME [--inquire] [!]element[&lt;TAB&gt;[!]child[..]] &lt;value&gt;
1341 </pre></div>
1342
1343 <p>Renames the specified <var>element</var> to the new <var>value</var>. If an element of
1344 the same name as the <var>value</var> already exists it will be overwritten.
1345 </p>
1346 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1347 arguments are retrieved via a server <em>INQUIRE</em>.
1348 </p>
1349
1350 <hr>
1351 <a name="RESET"></a>
1352 <div class="header">
1353 <p>
1354 Next: <a href="#SAVE" accesskey="n" rel="next">SAVE</a>, Previous: <a href="#RENAME" accesskey="p" rel="previous">RENAME</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1355 </div>
1356 <a name="RESET-command"></a>
1357 <h2 class="chapter">31 RESET command</h2>
1358 <a name="index-RESET-command"></a>
1359 <p>Syntax:
1360 </p><div class="example">
1361 <pre class="example">RESET
1362 </pre></div>
1363
1364 <p>Closes the currently opened file but keeps any previously set client options.
1365 </p>
1366
1367 <hr>
1368 <a name="SAVE"></a>
1369 <div class="header">
1370 <p>
1371 Next: <a href="#STORE" accesskey="n" rel="next">STORE</a>, Previous: <a href="#RESET" accesskey="p" rel="previous">RESET</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1372 </div>
1373 <a name="SAVE-command"></a>
1374 <h2 class="chapter">32 SAVE command</h2>
1375 <a name="index-SAVE-command"></a>
1376 <p>Syntax:
1377 </p><div class="example">
1378 <pre class="example">SAVE [--no-passphrase] [--reset] [--no-agent] [--s2k-count=N] [--cipher=&lt;algo&gt;] [--cipher-iterations=N] [--inquire-keyparam] [--keygrip=hexstring] [--sign-keygrip=hexstring]
1379 </pre></div>
1380
1381 <p>Writes the <abbr>XML</abbr> document to disk. The file written to is the file that
1382 was opened using the <code>OPEN</code> command (see <a href="#OPEN">OPEN</a>). If the file is a
1383 new one or the option <samp>--inquire-keyparam</samp> was passed, then a new
1384 keypair will be generated and a pinentry will be used to prompt for the
1385 passphrase to encrypt with unless the <samp>--no-passphrase</samp> option was
1386 passed in which case the data file will not be passphrase protected.
1387 </p>
1388 <p>The <samp>--no-agent</samp> option disables use of <code>gpg-agent</code> for
1389 passphrase retrieval and caching of new files when <code>gpg-agent</code>
1390 use is enabled. The datafile will be symmetrically encrypted and will not
1391 use or generate any keypair.
1392 </p>
1393 <p>The <samp>--reset</samp> option will clear the cache entry for the current file
1394 and require a passphrase, if needed, before saving.
1395 </p>
1396 <p>The <samp>--cipher</samp> option can be used to encrypt the <abbr>XML</abbr> data to
1397 an alternate cipher. The default is <code>aes256</code>. See the Configuration
1398 (see <a href="#Configuration">Configuration</a>) for available ciphers.
1399 </p>
1400 <p>The <samp>--cipher-iterations</samp> option  specifies the number of times to
1401 encrypt the XML data. The default is 0 although 1 iteration is still done.
1402 </p>
1403 <p>The <samp>--inquire-keyparam</samp> option will send a server <em>INQUIRE</em> to
1404 the client to obtain the key paramaters to use when generating a new
1405 keypair. The inquired data is expected to be an S-expression. If not
1406 specified then an &lsquo;<samp>RSA</samp>&rsquo; key of &lsquo;<samp>2048</samp>&rsquo; bits will be generated
1407 unless otherwise set in the configuration file (see <a href="#Configuration">Configuration</a>). Note
1408 that when this option is specified a new keypair will be generated
1409 reguardless if the file is a new one and that if the data file is protected
1410 the passphrase to open it will be required before generating the new keypair.
1411 </p>
1412 <p>You can encrypt the data file to a public key other than the one that it
1413 was originally encrypted with by passing the <samp>--keygrip</samp> option with
1414 the hex encoded keygrip of the public key as its argument. The keygrip may
1415 be of any key that <code>gpg-agent</code> knows about. The
1416 <samp>--sign-keygrip</samp> option may also be used to sign with an alternate
1417 secret key. This option may be needed when using a smartcard. This option
1418 has no effect with symmetrically encrypted data files.
1419 </p>
1420 <p>The <samp>--s2k-count</samp> option sets number of hash iterations for a
1421 passphrase. A value less-than <code>65536</code> will use the machine calibrated
1422 value and is the default. This setting only affects new files. To change
1423 the setting use the <code>PASSWD</code> command (see <a href="#PASSWD">PASSWD</a>). This option
1424 has no effect with symmetrically encrypted data files.
1425 </p>
1426
1427 <hr>
1428 <a name="STORE"></a>
1429 <div class="header">
1430 <p>
1431 Next: <a href="#UNLOCK" accesskey="n" rel="next">UNLOCK</a>, Previous: <a href="#SAVE" accesskey="p" rel="previous">SAVE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1432 </div>
1433 <a name="STORE-command"></a>
1434 <h2 class="chapter">33 STORE command</h2>
1435 <a name="index-STORE-command"></a>
1436 <p>Syntax:
1437 </p><div class="example">
1438 <pre class="example">STORE [!]element[&lt;TAB&gt;[!]child[..]]&lt;TAB&gt;[content]
1439 </pre></div>
1440
1441 <p>This command uses a server <em>INQUIRE</em> to retrieve data from the client.
1442 </p>
1443 <p>Creates a new element path or modifies the <var>content</var> of an existing
1444 element. If only a single element is specified then a new root element is
1445 created. Otherwise, elements are <tt class="key">TAB</tt> delimited and the content will be
1446 set to the final <tt class="key">TAB</tt> delimited element. If no <var>content</var> is
1447 specified after the final <tt class="key">TAB</tt>, then the content of the element will
1448 be removed, or empty when creating a new element.
1449 </p>
1450 <p>The only restriction of an element name is that it not contain whitespace
1451 or begin with the literal element character <code>!</code> unless specifying a
1452 literal element (see <a href="#Target-Attribute">Target Attribute</a>). There is no whitespace between
1453 the <tt class="key">TAB</tt> delimited elements. It is recommended that the content of an
1454 element be base64 encoded when it contains control or <tt class="key">TAB</tt> characters
1455 to prevent <abbr>XML</abbr> parsing and <code>pwmd</code> syntax errors.
1456 </p>
1457
1458 <hr>
1459 <a name="UNLOCK"></a>
1460 <div class="header">
1461 <p>
1462 Next: <a href="#XPATH" accesskey="n" rel="next">XPATH</a>, Previous: <a href="#STORE" accesskey="p" rel="previous">STORE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1463 </div>
1464 <a name="UNLOCK-command"></a>
1465 <h2 class="chapter">34 UNLOCK command</h2>
1466 <a name="index-UNLOCK-command"></a>
1467 <p>Syntax:
1468 </p><div class="example">
1469 <pre class="example">UNLOCK
1470 </pre></div>
1471
1472 <p>Unlocks the file mutex which was locked with the <code>LOCK</code> command or
1473 a commands&rsquo; <samp>--lock</samp> option (see <a href="#LOCK">LOCK</a>, see <a href="#OPEN">OPEN</a>,
1474 see <a href="#ISCACHED">ISCACHED</a>).
1475 </p>
1476
1477 <hr>
1478 <a name="XPATH"></a>
1479 <div class="header">
1480 <p>
1481 Next: <a href="#XPATHATTR" accesskey="n" rel="next">XPATHATTR</a>, Previous: <a href="#UNLOCK" accesskey="p" rel="previous">UNLOCK</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1482 </div>
1483 <a name="XPATH-command"></a>
1484 <h2 class="chapter">35 XPATH command</h2>
1485 <a name="index-XPATH-command"></a>
1486 <p>Syntax:
1487 </p><div class="example">
1488 <pre class="example">XPATH [--inquire] &lt;expression&gt;[&lt;TAB&gt;[value]]
1489 </pre></div>
1490
1491 <p>Evaluates an XPath <var>expression</var>. If no <var>value</var> argument is
1492 specified it is assumed the expression is a request to return a result.
1493 Otherwise, the result is set to the <var>value</var> argument and the document is
1494 updated. If there is no <var>value</var> after the <tt class="key">TAB</tt> character, the value
1495 is assumed to be empty and the document is updated. For example:
1496 </p><br>
1497 <div class="example">
1498 <pre class="example">XPATH //element[@_name='password']<span class="key">TAB</span>
1499 </pre></div>
1500 <br>
1501 <p>would clear the content of all <code>password</code> elements in the data file
1502 while leaving off the trailing <tt class="key">TAB</tt> would return all <code>password</code>
1503 elements in <abbr>XML</abbr> format.
1504 </p>
1505 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1506 arguments are retrieved via a server <em>INQUIRE</em>.
1507 </p>
1508 <p>See <a href="http://www.w3schools.com/xpath/xpath_syntax.asp">http://www.w3schools.com/xpath/xpath_syntax.asp</a> for <abbr>XPATH</abbr>
1509 expression syntax.
1510 </p>
1511
1512 <hr>
1513 <a name="XPATHATTR"></a>
1514 <div class="header">
1515 <p>
1516 Previous: <a href="#XPATH" accesskey="p" rel="previous">XPATH</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1517 </div>
1518 <a name="XPATHATTR-command"></a>
1519 <h2 class="chapter">36 XPATHATTR command</h2>
1520 <a name="index-XPATHATTR-command"></a>
1521 <p>Syntax:
1522 </p><div class="example">
1523 <pre class="example">XPATHATTR [--inquire] SET|DELETE &lt;name&gt; &lt;expression&gt;[&lt;TAB&gt;[&lt;value&gt;]]
1524 </pre></div>
1525
1526 <p>Like the <code>XPATH</code> command (see <a href="#XPATH">XPATH</a>) but operates on element
1527 attributes and does not return a result. For the <var>SET</var> operation the
1528 <var>value</var> is optional but the field is required. If not specified then
1529 the attribute value will be empty. For example:
1530 </p><br>
1531 <div class="example">
1532 <pre class="example">XPATHATTR SET password //element[@_name='password']<span class="key">TAB</span>
1533 </pre></div>
1534 <br>
1535 <p>would create an <code>password</code> attribute for each <code>password</code> element
1536 found in the document. The attribute value will be empty but still exist.
1537 </p>
1538 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1539 arguments are retrieved via a server <em>INQUIRE</em>.
1540 </p>
1541 <p>See <a href="http://www.w3schools.com/xpath/xpath_syntax.asp">http://www.w3schools.com/xpath/xpath_syntax.asp</a> for <abbr>XPATH</abbr>
1542 expression syntax.
1543 </p>
1544
1545
1546 <hr>
1547 <a name="Status-Messages"></a>
1548 <div class="header">
1549 <p>
1550 Next: <a href="#Target-Attribute" accesskey="n" rel="next">Target Attribute</a>, Previous: <a href="#Commands" accesskey="p" rel="previous">Commands</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1551 </div>
1552 <a name="Status-messages-and-their-meanings"></a>
1553 <h2 class="chapter">37 Status messages and their meanings</h2>
1554 <p>Some commands send status messages to inform the client about certain
1555 operations or as a progress indicator.  Status messages begin with a
1556 <code>KEYWORD</code> followed by a status description for status messages that
1557 require it. What status messages are sent, when, and how often depend on
1558 configuration settings (see <a href="#Configuration">Configuration</a>). A status message sent from
1559 <code>gpg-agent</code> (See <a href="http://www.gnupg.org/documentation/manuals/gnupg/Invoking-GPG_002dAGENT.html#Invoking-GPG_002dAGENT">(gnupg)Invoking GPG-AGENT</a>) is also forwarded to
1560 the client.
1561 </p>
1562 <table>
1563 <thead><tr><th width="20%">Message</th><th width="25%">Arguments</th><th width="55%">Description</th></tr></thead>
1564 <tr><td width="20%">CACHE
1565 <a name="index-CACHE"></a></td><td width="25%"><code>&lt;integer&gt;</code></td><td width="55%">The number of cached documents. Sent to each client after connecting
1566 (see <a href="#GETINFO">GETINFO</a>) and after every cache modification.</td></tr>
1567 <tr><td width="20%">CLIENTS
1568 <a name="index-CLIENTS"></a></td><td width="25%"><code>&lt;integer&gt;</code></td><td width="55%">The number of connected clients (see <a href="#GETINFO">GETINFO</a>). Sent to each client
1569 when another client either connects or disconnects.</td></tr>
1570 <tr><td width="20%">DECRYPT
1571 <a name="index-DECRYPT"></a></td><td width="25%"><code>n</code> <code>total</code></td><td width="55%">Sent to the current client during a decrypt operation. How often this
1572 status message is sent is determined by the <code>cipher_progress</code>
1573 (see <a href="#Configuration">Configuration</a>) setting.</td></tr>
1574 <tr><td width="20%">ENCRYPT
1575 <a name="index-ENCRYPT"></a></td><td width="25%"><code>n</code> <code>total</code></td><td width="55%">Sent to the current client during an  encrypt operation. How often this
1576 status message is sent is determined by the <code>cipher_progress</code>
1577 (see <a href="#Configuration">Configuration</a>) setting.</td></tr>
1578 <tr><td width="20%">GENKEY
1579 <a name="index-GENKEY"></a></td><td width="25%"></td><td width="55%">Sent once to the current client just before generating a new key-pair.</td></tr>
1580 <tr><td width="20%">INQUIRE_MAXLEN
1581 <a name="index-INQUIRE_005fMAXLEN"></a></td><td width="25%"><code>&lt;bytes&gt;</code></td><td width="55%">Sent to the client from <code>gpg-agent</code> when inquiring data. This
1582 specifies the maximum number of bytes allowed for the client to send and
1583 should not be exceeded.</td></tr>
1584 <tr><td width="20%">KEEPALIVE
1585 <a name="index-KEEPALIVE"></a></td><td width="25%"></td><td width="55%">Sent to each idle client every <var>keepalive_interval</var>
1586 (see <a href="#Configuration">Configuration</a>) seconds.</td></tr>
1587 <tr><td width="20%">LOCKED
1588 <a name="index-LOCKED"></a></td><td width="25%"></td><td width="55%">Sent to the current client when another client is holding the lock for
1589 the mutex associated with a file.</td></tr>
1590 <tr><td width="20%">NEWFILE
1591 <a name="index-NEWFILE"></a></td><td width="25%"></td><td width="55%">Sent to the current client when the opened (see <a href="#OPEN">OPEN</a>) file does not
1592 exist on the file-system.</td></tr>
1593 <tr><td width="20%">XFER
1594 <a name="index-XFER"></a></td><td width="25%"><code>&lt;sent&gt; &lt;total&gt;</code></td><td width="55%">Sent to the current client when transferring data. It has two space
1595 delimited arguments. The first being the current amount of bytes transferred
1596 and the other being the total bytes to be transferred.</td></tr>
1597 </table>
1598
1599 <hr>
1600 <a name="Target-Attribute"></a>
1601 <div class="header">
1602 <p>
1603 Next: <a href="#Signals" accesskey="n" rel="next">Signals</a>, Previous: <a href="#Status-Messages" accesskey="p" rel="previous">Status Messages</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1604 </div>
1605 <a name="The-target-attribute"></a>
1606 <h2 class="chapter">38 The <code>target</code> attribute</h2>
1607 <a name="index-target-attribute"></a>
1608 <p>A <em>case sensitive</em> attribute named <code>target</code> is treated specially
1609 when found in each element of an element path. This attribute, like other
1610 element attributes, is created or modified with the <code>ATTR</code> command
1611 (see <a href="#ATTR">ATTR</a>). The value of this attribute is an existing element path
1612 somewhere in the document.  If you are familiar with <abbr>XML</abbr> entities or
1613 maybe the <abbr>HTML</abbr> <code>id</code> or <code>target</code> attributes or a symbolic link
1614 in a file-system, you may find this attribute behaves similar to any of those.
1615 </p>
1616 <p>To create a <code>target</code> attribute use the following syntax:
1617 </p>
1618 <div class="example">
1619 <pre class="example">ATTR SET target [!]element[<span class="key">TAB</span>[!]child[..]] [!]element[<span class="key">TAB</span>[!]child[..]]
1620 </pre></div>
1621
1622 <p>Note the single space between the two element paths. The first element path is
1623 where the <code>target</code> attribute will be created. If the element path does
1624 not exist then it will be created.  This is the only time the <code>ATTR</code>
1625 (see <a href="#ATTR">ATTR</a>) command will create elements. The attribute is created in the
1626 final element of the element path.
1627 </p>
1628 <p>The second element path is the destination of where you want the first element
1629 path to resolve to. When an element path is passed to a protocol command
1630 <code>pwmd</code> looks for a <code>target</code> attribute when resolving each element
1631 and if found, &quot;jumps&quot; to the attribute value and continues resolving any
1632 remaining elements.  When you want to avoid the <code>target</code> attribute for
1633 any element of an element path then prefix the element with the literal
1634 element character &lsquo;<samp>!</samp>&rsquo;.
1635 </p>
1636 <p>When an element of a element path is removed that a <code>target</code> attribute
1637 resolves to then an error will occur. You may need to either update the
1638 <code>target</code> attribute value with a new element path or remove the attribute
1639 entirely. Remember that since the element contains the <code>target</code> attribute
1640 it will need to be prefixed with the literal element character &lsquo;<samp>!</samp>&rsquo; when
1641 specifying the element path. For example, to remove a <code>target</code>
1642 attribute for an element containing it:
1643 </p>
1644 <div class="example">
1645 <pre class="example">ATTR DELETE target path<span class="key">TAB</span>to<span class="key">TAB</span>!element
1646 </pre></div>
1647
1648 <p>Clients should be careful of creating <code>target</code> loops, or targets that
1649 resolve to themselves. See the <var>recursion_depth</var> (see <a href="#Configuration">Configuration</a>)
1650 configuration parameter for details.
1651 </p>
1652 <p>The <code>REALPATH</code> command (see <a href="#REALPATH">REALPATH</a>) can be used to show the element
1653 path after resolving all <code>target</code> attributes.
1654 </p>
1655
1656 <hr>
1657 <a name="Signals"></a>
1658 <div class="header">
1659 <p>
1660 Next: <a href="#Concept-Index" accesskey="n" rel="next">Concept Index</a>, Previous: <a href="#Target-Attribute" accesskey="p" rel="previous">Target Attribute</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1661 </div>
1662 <a name="Recognized-signals"></a>
1663 <h2 class="chapter">39 Recognized signals</h2>
1664
1665 <p>Sending the <em>SIGHUP</em> signal to a <code>pwmd</code> process will reload the
1666 configuration file and sending <em>SIGUSR1</em> will clear the entire file
1667 cache.
1668 </p>
1669
1670
1671 <hr>
1672 <a name="Concept-Index"></a>
1673 <div class="header">
1674 <p>
1675 Previous: <a href="#Signals" accesskey="p" rel="previous">Signals</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1676 </div>
1677 <a name="Concept-Index-1"></a>
1678 <h2 class="unnumbered">Concept Index</h2>
1679
1680
1681 <a name="SEC_Overview"></a>
1682 <h2 class="shortcontents-heading">Short Table of Contents</h2>
1683
1684 <div class="shortcontents">
1685 <ul class="no-bullet">
1686 <li><a name="stoc-Overview-of-pwmd" href="#toc-Overview-of-pwmd">1 Overview of <code>pwmd</code></a></li>
1687 <li><a name="stoc-Invoking-pwmd" href="#toc-Invoking-pwmd">2 Invoking <code>pwmd</code></a></li>
1688 <li><a name="stoc-pwmd-configuration-file-options" href="#toc-pwmd-configuration-file-options">3 <code>pwmd</code> configuration file options</a></li>
1689 <li><a name="stoc-Configuring-remote-connections-over-TLS_002e" href="#toc-Configuring-remote-connections-over-TLS_002e">4 Configuring remote connections over TLS.</a></li>
1690 <li><a name="stoc-Pinentry-configuration" href="#toc-Pinentry-configuration">5 Pinentry configuration</a></li>
1691 <li><a name="stoc-Protocol-commands-and-their-syntax" href="#toc-Protocol-commands-and-their-syntax">6 Protocol commands and their syntax</a></li>
1692 <li><a name="stoc-AGENT-command" href="#toc-AGENT-command">7 AGENT command</a></li>
1693 <li><a name="stoc-ATTR-command" href="#toc-ATTR-command">8 ATTR command</a></li>
1694 <li><a name="stoc-CACHETIMEOUT-command" href="#toc-CACHETIMEOUT-command">9 CACHETIMEOUT command</a></li>
1695 <li><a name="stoc-CLEARCACHE-command" href="#toc-CLEARCACHE-command">10 CLEARCACHE command</a></li>
1696 <li><a name="stoc-COPY-command" href="#toc-COPY-command">11 COPY command</a></li>
1697 <li><a name="stoc-DELETE-command" href="#toc-DELETE-command">12 DELETE command</a></li>
1698 <li><a name="stoc-DUMP-command" href="#toc-DUMP-command">13 DUMP command</a></li>
1699 <li><a name="stoc-GET-command" href="#toc-GET-command">14 GET command</a></li>
1700 <li><a name="stoc-GETCONFIG-command" href="#toc-GETCONFIG-command">15 GETCONFIG command</a></li>
1701 <li><a name="stoc-GETINFO-command" href="#toc-GETINFO-command">16 GETINFO command</a></li>
1702 <li><a name="stoc-HELP-command" href="#toc-HELP-command">17 HELP command</a></li>
1703 <li><a name="stoc-IMPORT-command" href="#toc-IMPORT-command">18 IMPORT command</a></li>
1704 <li><a name="stoc-ISCACHED-command" href="#toc-ISCACHED-command">19 ISCACHED command</a></li>
1705 <li><a name="stoc-KEYGRIP-command" href="#toc-KEYGRIP-command">20 KEYGRIP command</a></li>
1706 <li><a name="stoc-LIST-command" href="#toc-LIST-command">21 LIST command</a></li>
1707 <li><a name="stoc-LOCK-command" href="#toc-LOCK-command">22 LOCK command</a></li>
1708 <li><a name="stoc-LS-command" href="#toc-LS-command">23 LS command</a></li>
1709 <li><a name="stoc-MOVE-command" href="#toc-MOVE-command">24 MOVE command</a></li>
1710 <li><a name="stoc-NOP-command" href="#toc-NOP-command">25 NOP command</a></li>
1711 <li><a name="stoc-OPEN-command" href="#toc-OPEN-command">26 OPEN command</a></li>
1712 <li><a name="stoc-OPTION-command" href="#toc-OPTION-command">27 OPTION command</a></li>
1713 <li><a name="stoc-PASSWD-command" href="#toc-PASSWD-command">28 PASSWD command</a></li>
1714 <li><a name="stoc-REALPATH-command" href="#toc-REALPATH-command">29 REALPATH command</a></li>
1715 <li><a name="stoc-RENAME-command" href="#toc-RENAME-command">30 RENAME command</a></li>
1716 <li><a name="stoc-RESET-command" href="#toc-RESET-command">31 RESET command</a></li>
1717 <li><a name="stoc-SAVE-command" href="#toc-SAVE-command">32 SAVE command</a></li>
1718 <li><a name="stoc-STORE-command" href="#toc-STORE-command">33 STORE command</a></li>
1719 <li><a name="stoc-UNLOCK-command" href="#toc-UNLOCK-command">34 UNLOCK command</a></li>
1720 <li><a name="stoc-XPATH-command" href="#toc-XPATH-command">35 XPATH command</a></li>
1721 <li><a name="stoc-XPATHATTR-command" href="#toc-XPATHATTR-command">36 XPATHATTR command</a></li>
1722 <li><a name="stoc-Status-messages-and-their-meanings" href="#toc-Status-messages-and-their-meanings">37 Status messages and their meanings</a></li>
1723 <li><a name="stoc-The-target-attribute" href="#toc-The-target-attribute">38 The <code>target</code> attribute</a></li>
1724 <li><a name="stoc-Recognized-signals" href="#toc-Recognized-signals">39 Recognized signals</a></li>
1725 <li><a name="stoc-Concept-Index-1" href="#toc-Concept-Index-1">Concept Index</a></li>
1726
1727 </ul>
1728 </div>
1729
1730 <a name="SEC_Contents"></a>
1731 <h2 class="contents-heading">Table of Contents</h2>
1732
1733 <div class="contents">
1734 <ul class="no-bullet">
1735 <li><a name="toc-Overview-of-pwmd" href="#Introduction">1 Overview of <code>pwmd</code></a></li>
1736 <li><a name="toc-Invoking-pwmd" href="#Invoking">2 Invoking <code>pwmd</code></a></li>
1737 <li><a name="toc-pwmd-configuration-file-options" href="#Configuration">3 <code>pwmd</code> configuration file options</a></li>
1738 <li><a name="toc-Configuring-remote-connections-over-TLS_002e" href="#TLS">4 Configuring remote connections over TLS.</a></li>
1739 <li><a name="toc-Pinentry-configuration" href="#Pinentry">5 Pinentry configuration</a></li>
1740 <li><a name="toc-Protocol-commands-and-their-syntax" href="#Commands">6 Protocol commands and their syntax</a></li>
1741 <li><a name="toc-AGENT-command" href="#AGENT">7 AGENT command</a></li>
1742 <li><a name="toc-ATTR-command" href="#ATTR">8 ATTR command</a></li>
1743 <li><a name="toc-CACHETIMEOUT-command" href="#CACHETIMEOUT">9 CACHETIMEOUT command</a></li>
1744 <li><a name="toc-CLEARCACHE-command" href="#CLEARCACHE">10 CLEARCACHE command</a></li>
1745 <li><a name="toc-COPY-command" href="#COPY">11 COPY command</a></li>
1746 <li><a name="toc-DELETE-command" href="#DELETE">12 DELETE command</a></li>
1747 <li><a name="toc-DUMP-command" href="#DUMP">13 DUMP command</a></li>
1748 <li><a name="toc-GET-command" href="#GET">14 GET command</a></li>
1749 <li><a name="toc-GETCONFIG-command" href="#GETCONFIG">15 GETCONFIG command</a></li>
1750 <li><a name="toc-GETINFO-command" href="#GETINFO">16 GETINFO command</a></li>
1751 <li><a name="toc-HELP-command" href="#HELP">17 HELP command</a></li>
1752 <li><a name="toc-IMPORT-command" href="#IMPORT">18 IMPORT command</a></li>
1753 <li><a name="toc-ISCACHED-command" href="#ISCACHED">19 ISCACHED command</a></li>
1754 <li><a name="toc-KEYGRIP-command" href="#KEYGRIP">20 KEYGRIP command</a></li>
1755 <li><a name="toc-LIST-command" href="#LIST">21 LIST command</a></li>
1756 <li><a name="toc-LOCK-command" href="#LOCK">22 LOCK command</a></li>
1757 <li><a name="toc-LS-command" href="#LS">23 LS command</a></li>
1758 <li><a name="toc-MOVE-command" href="#MOVE">24 MOVE command</a></li>
1759 <li><a name="toc-NOP-command" href="#NOP">25 NOP command</a></li>
1760 <li><a name="toc-OPEN-command" href="#OPEN">26 OPEN command</a></li>
1761 <li><a name="toc-OPTION-command" href="#OPTION">27 OPTION command</a></li>
1762 <li><a name="toc-PASSWD-command" href="#PASSWD">28 PASSWD command</a></li>
1763 <li><a name="toc-REALPATH-command" href="#REALPATH">29 REALPATH command</a></li>
1764 <li><a name="toc-RENAME-command" href="#RENAME">30 RENAME command</a></li>
1765 <li><a name="toc-RESET-command" href="#RESET">31 RESET command</a></li>
1766 <li><a name="toc-SAVE-command" href="#SAVE">32 SAVE command</a></li>
1767 <li><a name="toc-STORE-command" href="#STORE">33 STORE command</a></li>
1768 <li><a name="toc-UNLOCK-command" href="#UNLOCK">34 UNLOCK command</a></li>
1769 <li><a name="toc-XPATH-command" href="#XPATH">35 XPATH command</a></li>
1770 <li><a name="toc-XPATHATTR-command" href="#XPATHATTR">36 XPATHATTR command</a></li>
1771 <li><a name="toc-Status-messages-and-their-meanings" href="#Status-Messages">37 Status messages and their meanings</a></li>
1772 <li><a name="toc-The-target-attribute" href="#Target-Attribute">38 The <code>target</code> attribute</a></li>
1773 <li><a name="toc-Recognized-signals" href="#Signals">39 Recognized signals</a></li>
1774 <li><a name="toc-Concept-Index-1" href="#Concept-Index">Concept Index</a></li>
1775
1776 </ul>
1777 </div>
1778
1779 <hr>
1780
1781
1782
1783 </body>
1784 </html>