| blob | ea1d074776b26f40bdf01d36b7a3e903350fabda |
2 <html>
3 <!-- Created by GNU Texinfo 7.1.1, https://www.gnu.org/software/texinfo/ -->
4 <head>
20 <!--
31 -->
32 </style>
35 </head>
44 <p>
45 Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
46 </div>
56 <li><a id="toc-Overview-of-pwmd" href="#Introduction">1 Overview of <code class="command">pwmd</code></a></li>
59 <li><a id="toc-Invoking-pwmd" href="#Invoking">4 Invoking <code class="command">pwmd</code></a></li>
60 <li><a id="toc-pwmd-configuration-file-options" href="#Configuration">5 <code class="command">pwmd</code> configuration file options</a></li>
61 <li><a id="toc-Configuring-remote-connections-over-TLS_002e" href="#TLS">6 Configuring remote connections over TLS.</a></li>
63 <li><a id="toc-Protocol-commands-and-their-syntax" href="#Commands">8 Protocol commands and their syntax</a>
65 <li><a id="toc-Modifying-element-attributes_002e" href="#ATTR">8.1 Modifying element attributes.</a></li>
66 <li><a id="toc-Run-a-series-of-commands-in-sequence_002e" href="#BULK">8.2 Run a series of commands in sequence.</a></li>
67 <li><a id="toc-Setting-the-cache-timeout_002e" href="#CACHETIMEOUT">8.3 Setting the cache timeout.</a></li>
68 <li><a id="toc-Removing-a-cache-entry_002e" href="#CLEARCACHE">8.4 Removing a cache entry.</a></li>
71 <li><a id="toc-Deleting-a-key-from-the-key-ring_002e" href="#DELETEKEY">8.7 Deleting a key from the key ring.</a></li>
72 <li><a id="toc-Showing-the-XML-document_002e" href="#DUMP">8.8 Showing the XML document.</a></li>
74 <li><a id="toc-Getting-the-content-of-an-element_002e" href="#GET">8.10 Getting the content of an element.</a></li>
75 <li><a id="toc-Obtaining-a-configuration-value_002e" href="#GETCONFIG">8.11 Obtaining a configuration value.</a></li>
76 <li><a id="toc-Obtaining-server-and-client-information_002e" href="#GETINFO">8.12 Obtaining server and client information.</a></li>
77 <li><a id="toc-Showing-available-commands_002e" href="#HELP">8.13 Showing available commands.</a></li>
78 <li><a id="toc-Creating-elements-from-XML_002e" href="#IMPORT">8.14 Creating elements from XML.</a></li>
80 <li><a id="toc-Showing-keys-used-for-the-current-data-file_002e" href="#KEYINFO">8.16 Showing keys used for the current data file.</a></li>
81 <li><a id="toc-Terminating-another-client_002e" href="#KILL">8.17 Terminating another client.</a></li>
82 <li><a id="toc-Showing-document-elements_002e" href="#LIST">8.18 Showing document elements.</a></li>
83 <li><a id="toc-Listing-keys-in-the-key-ring_002e" href="#LISTKEYS">8.19 Listing keys in the key ring.</a></li>
84 <li><a id="toc-Locking-the-current-data-file_002e" href="#LOCK">8.20 Locking the current data file.</a></li>
85 <li><a id="toc-Showing-available-data-files_002e" href="#LS">8.21 Showing available data files.</a></li>
89 <li><a id="toc-Setting-various-client-parameters_002e" href="#OPTION">8.25 Setting various client parameters.</a></li>
90 <li><a id="toc-Changing-the-passphrase-for-a-key_002e" href="#PASSWD">8.26 Changing the passphrase for a key.</a></li>
93 <li><a id="toc-Resetting-the-client-state_002e" href="#RESET">8.29 Resetting the client state.</a></li>
94 <li><a id="toc-Saving-document-changes-to-disk_002e" href="#SAVE">8.30 Saving document changes to disk.</a></li>
95 <li><a id="toc-Modifying-the-content-of-an-element_002e" href="#STORE">8.31 Modifying the content of an element.</a></li>
96 <li><a id="toc-Removing-a-data-file-lock_002e" href="#UNLOCK">8.32 Removing a data file lock.</a></li>
97 <li><a id="toc-Modifying-more-than-one-element_002e" href="#XPATH">8.33 Modifying more than one element.</a></li>
98 <li><a id="toc-Modifying-more-than-one-element_0027s-attributes_002e" href="#XPATHATTR">8.34 Modifying more than one element’s attributes.</a></li>
99 </ul></li>
100 <li><a id="toc-Running-multiple-commands-in-sequence" href="#Bulk-Commands">9 Running multiple commands in sequence</a></li>
101 <li><a id="toc-Status-messages-and-their-meanings" href="#Status-Messages">10 Status messages and their meanings</a></li>
102 <li><a id="toc-The-target-attribute" href="#Target-Attribute">11 The <code class="code">target</code> attribute</a></li>
103 <li><a id="toc-Other-special-attributes" href="#Other-Attributes">12 Other special attributes</a></li>
107 </ul>
108 </div>
109 </div>
110 <hr>
113 <p>
114 Next: <a href="#Access-Control" accesskey="n" rel="next">Access Control</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
115 </div>
116 <h2 class="chapter" id="Overview-of-pwmd"><span>1 Overview of <code class="command">pwmd</code><a class="copiable-link" href="#Overview-of-pwmd"> ¶</a></span></h2>
123 <p><em class="dfn">Password Manager Daemon</em> (or <code class="command">pwmd</code>) is a server that users or
124 applications connect to and send commands to store and retrieve data that is
125 stored in an OpenPGP encrypted <abbr class="acronym">XML</abbr> document. It mimics a filesystem
126 in a lot of ways including per element <abbr class="acronym">ACL</abbr>’s, but also has the
128 document cache is needed for a data file encrypted with secret keys stored on
130 </p>
131 <p>The server uses the Assuan protocol and is the same used by
132 <code class="command">gpg-agent</code>, <code class="command">pinentry</code>, <code class="command">gpgme</code> and
133 <code class="command">scdaemon</code>. It also uses <cite class="cite">libgpg-error</cite> for error reporting with
135 </p>
137 <p>The <abbr class="acronym">XML</abbr> document uses the following <abbr class="acronym">DTD</abbr>:
138 </p>
141 <!DOCTYPE pwmd [
144 ]>
145 </pre></div>
147 <p>The <code class="code">pwmd</code> element is the document root node while all other elements
148 of the document have the name <code class="code">element</code> with an attribute <code class="code">_name</code>
149 whose value uniquely identifies the element at the current element tree depth.
151 characters. A <abbr class="acronym">URL</abbr> for example would be an invalid <abbr class="acronym">XML</abbr>
152 element since the <abbr class="acronym">URI</abbr> contains a ‘<samp class="samp">:</samp>’ which is also the
154 </p>
155 <p>As mentioned, an element name must be unique for the current element tree
156 depth. You cannot have two elements containing the same <code class="code">_name</code> attribute
157 value. <code class="command">pwmd</code> will stop searching for an element of an <em class="emph">element
158 path</em> at the first match then continue searching for the next element of the
159 element path beginning at the child node of the matched element.
160 </p>
161 <p>An <em class="emph">element path</em> is a <code class="code">TAB</code> delimited character string where each
163 <code class="code">a<code class="code">TAB</code>b<code class="code">TAB</code>c</code> has the following <abbr class="acronym">XML</abbr> document
164 structure:
165 </p>
171 [... element value or content ...]
176 </pre></div>
178 <p>The only restriction of an element name is that it contain no whitespace
179 characters.
180 </p>
181 <hr>
182 </div>
185 <p>
186 Next: <a href="#Cache-Control" accesskey="n" rel="next">Cache Control</a>, Previous: <a href="#Introduction" accesskey="p" rel="prev">Overview of <code class="command">pwmd</code></a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
187 </div>
188 <h2 class="chapter" id="Access-Control-1"><span>2 Access Control<a class="copiable-link" href="#Access-Control-1"> ¶</a></span></h2>
190 <p>Like a filesystem has an <abbr class="acronym">ACL</abbr> to grant or limit access to directories
191 or files for a specific user or group, <code class="command">pwmd</code> can limit a local user,
192 group, <abbr class="acronym">TLS</abbr> connection or a command to a specific element path. This
193 is done by storing an <abbr class="acronym">ACL</abbr> in the element attribute <var class="var">_acl</var>. Its
195 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) with the exception that a <abbr class="acronym">TLS</abbr> fingerprint
197 </p>
198 <p>Access is denied for any user that is not in the <abbr class="acronym">ACL</abbr> of an element
201 path otherwise an error is returned.
202 </p>
206 element. An <var class="var">invoking_user</var> may always modify an <abbr class="acronym">ACL</abbr>. As an
207 example:
208 </p>
210 <pre class="example-preformatted"><element _name="test" _acl="username,-@wheel,root,#ABCDEF,/usr/bin/pwmc">
213 </pre></div>
215 <p>The user <code class="code">username</code> would be allowed both read and write access to the
216 <code class="code">test</code> element but not if it is a member of the <code class="code">wheel</code> group
217 although, the <code class="code">root</code> user, who may be a member of the <code class="code">wheel</code> group,
219 <code class="code">#ABCDEF</code> is also allowed. No users other than an <var class="var">invoking_user</var>
223 The ability to specify read and write access for each user in an <abbr class="acronym">ACL</abbr>
224 is a feature planned for a later release.
225 </p>
226 <hr>
227 </div>
230 <p>
231 Next: <a href="#Invoking" accesskey="n" rel="next">Invoking <code class="command">pwmd</code></a>, Previous: <a href="#Access-Control" accesskey="p" rel="prev">Access Control</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
232 </div>
233 <h2 class="chapter" id="Cache-Control-1"><span>3 Cache Control<a class="copiable-link" href="#Cache-Control-1"> ¶</a></span></h2>
237 <p>While <code class="command">pwmd</code> has its own cache settings for an <abbr class="acronym">XML</abbr> document,
238 <code class="command">gpg-agent</code> has cache settings for the keys used for crypto operations
240 <samp class="option">default-cache-ttl</samp> and <samp class="option">max-cache-ttl</samp> options. These
243 open a data file due to the gpg-agent having a cached key even though the
245 cached; which usually means a passphrase would be required. Keys for symmetric
248 </p>
249 <p>A copy-on-write operation is done for commands that modify the document; the
250 client that invoked the command will work on a copy of the in-memory document.
251 The first client to <code class="code">SAVE</code> the changes to disk will require other clients
252 to reopen the data file due to the checksum being updated.
253 </p>
254 <hr>
255 </div>
258 <p>
259 Next: <a href="#Configuration" accesskey="n" rel="next"><code class="command">pwmd</code> configuration file options</a>, Previous: <a href="#Cache-Control" accesskey="p" rel="prev">Cache Control</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
260 </div>
261 <h2 class="chapter" id="Invoking-pwmd"><span>4 Invoking <code class="command">pwmd</code><a class="copiable-link" href="#Invoking-pwmd"> ¶</a></span></h2>
267 a separate <code class="command">gpg-agent</code> process when <var class="var">gpg_homedir</var>
268 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) is not set to an instance of an already running
269 gpg-agent. Any <code class="command">gpg</code> configuration options that you need set should be
270 put in <var class="var">~/.pwmd/.gnupg/gpg.conf</var> or the <var class="var">gpg.conf</var> file located in
271 <var class="var">gpg_homedir</var>. The same is true for the <var class="var">gpg-agent.conf</var> file to set
273 </p>
275 option to <code class="command">gpg-agent</code>. Doing so allows <code class="command">pwmd</code>
276 cache pushing on startup. It is also recommended to pass the
277 <samp class="option">--allow-loopback-pinentry</samp> to <code class="command">gpg-agent</code> (this is the default
278 as of gnupg-2.1.15). This option allows a passphrase to be inquired from
279 <code class="command">pwmd</code> when a <code class="command">pinentry</code> is unavailable to the client
281 </p>
282 <p>If you would like to use a keypair from your default gnupg keyring located in
283 ~/.gnupg, but would still like to use a separate gpg-agent process (the
284 default), you would need to first export the public key from the default
285 keyring then import it into the keyring that pwmd uses. You can do this by
286 first exporting the public key, then use the <samp class="option">--homedir ~/.pwmd/.gnupg</samp>
288 you would need to copy the private key associated with the exported public key
292 </p>
295 </p>
298 </pre></div>
300 <p>Non-option arguments are data files to cache upon startup. When the data file
304 </p>
307 <p>The following command line options are supported:
308 </p>
312 <dd><p>Enable debugging output. This option can output sensitive information such as
313 passphrases and secret keys so care should be taken where the output gets
315 to log. Use <code class="code">a</code> for <code class="code">libassuan</code> with <var class="var">level</var> being one or more
316 character flags: <code class="code">i</code> for init, <code class="code">x</code> for context, <code class="code">e</code> for engine,
317 <code class="code">d</code> for data, <code class="code">s</code> for system IO or <code class="code">c</code> for control. To debug
318 <code class="code">gpgme</code> use <code class="code">g</code> as the <var class="var">protocol</var> with <var class="var">level</var> being an
319 integer from <code class="code">1</code> to <code class="code">9</code>. To enable <abbr class="acronym">TLS</abbr> debugging output
320 use <code class="code">t</code> as the <var class="var">protocol</var> with <var class="var">level</var> being an integer from
321 <code class="code">1</code> to <code class="code">9</code>. A value over <code class="code">10</code> will enable all <abbr class="acronym">TLS</abbr>
323 </p>
324 </dd>
326 <dd><p>The root directory where pwmd will store its data and temporary files. The
328 </p>
329 </dd>
331 <dd><p>Specify an alternate configuration file. The default is
333 </p>
334 </dd>
336 <dd><p>Terminate an existing instance of pwmd. The process to terminate is determined
337 from the <samp class="option">--homedir</samp> and <samp class="option">--rcfile</samp> options.
338 </p>
339 </dd>
341 <dd><p>Imports the <abbr class="acronym">XML</abbr> <var class="var">filename</var>. When <var class="var">filename</var> is <code class="code">-</code> the
342 <abbr class="acronym">XML</abbr> is read from <code class="code">stdin</code>. The <abbr class="acronym">XML</abbr> file should be in conformance to
343 the <code class="command">pwmd</code> <abbr class="acronym">DTD</abbr> (see <a class="pxref" href="#Introduction">Overview of <code class="command">pwmd</code></a>). You will be prompted for
344 a passphrase to encrypt with. The output is written to the filename specified
347 </p>
348 </dd>
351 <var class="var">filename</var> is <code class="code">-</code> output will be written to <code class="code">stdout</code>.
352 </p>
353 </dd>
355 <dd><p>Obtain the passphrase to use when importing from the specified <var class="var">filename</var>.
356 </p>
357 </dd>
359 <dd><p>Specifies the fingerprint of the encryption key to use as a recipient when
360 importing. When not specified a new key-pair will be created.
361 </p>
362 </dd>
364 <dd><p>Specifies the fingerprint of the signing key to use for signing of the data
365 file when importing. When not specified the signing key of the generated
367 </p>
368 </dd>
370 <dd><p>Use symmetric or conventional encryption rather than pubic key encryption when
372 option. By default no signing is done when specifying this option.
373 </p>
374 </dd>
376 <dd><p>When importing, the user id used to identify the generated key. This should be
378 </p>
379 </dd>
381 <dd><p>When importing, the algorithm to use when generating the new key pair. The
383 </p>
384 </dd>
386 <dd><p>When importing, the time, in seconds since epoch, when the generated key will
388 years.
389 </p>
390 </dd>
393 </p>
394 </dd>
396 <dd><p>Disable the <code class="code">XPATH</code>, <code class="code">XPATHATTR</code>, <code class="code">LIST</code> and <code class="code">DUMP</code>
397 protocol commands (see <a class="pxref" href="#Commands">Protocol commands and their syntax</a>). This overrides any
398 <var class="var">disable_list_and_dump</var> configuration parameter (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>).
399 </p>
400 </dd>
402 <dd><p>Run as a foreground process and do not fork into the background.
403 </p>
404 </dd>
406 <dd><p>Ignore cache pushing failures on startup. By default, <code class="command">pwmd</code> will exit
407 if an error occurred due to an invalid passphrase or other error.
408 </p>
409 </dd>
411 <dd><p>Show the version, copyright and compile time features and exit.
412 </p>
413 </dd>
415 <dd><p>Print a summary of options.
416 </p></dd>
417 </dl>
420 <hr>
421 </div>
424 <p>
425 Next: <a href="#TLS" accesskey="n" rel="next">Configuring remote connections over TLS.</a>, Previous: <a href="#Invoking" accesskey="p" rel="prev">Invoking <code class="command">pwmd</code></a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
426 </div>
427 <h2 class="chapter" id="pwmd-configuration-file-options"><span>5 <code class="command">pwmd</code> configuration file options<a class="copiable-link" href="#pwmd-configuration-file-options"> ¶</a></span></h2>
430 <p>If no configuration file is specified with the <code class="command">pwmd</code> <samp class="option">-f</samp>
431 command line option, <code class="command">pwmd</code> will read <samp class="file">~/.pwmd/config</samp> if it
432 exists, and if not, will use defaults. Blank lines and lines beginning with
433 ‘<samp class="samp">#</samp>’ are ignored. Some parameters may have data file specific settings by
434 placing them in a file section. A file section is declared by surrounding the
435 filename with braces (i.e., ‘<samp class="samp">[filename]</samp>’). Global options may be
436 specified in the <code class="code">global</code> section (e.g., ‘<samp class="samp">[global]</samp>’) and are the
437 default options for new or unspecified file sections.
438 </p>
439 <p>A tilde <code class="code">~</code> will be expanded to the home directory of the user starting
441 </p>
444 a <code class="command">pwmd</code> process. Some security sensitive settings may not be changed
446 </p>
449 </p>
451 <dt><a id="index-socket_005fpath"></a><span>‘<samp class="samp">socket_path = /path/to/socket</samp>’<a class="copiable-link" href="#index-socket_005fpath"> ¶</a></span></dt>
453 </p>
454 </dd>
455 <dt><a id="index-socket_005fperms"></a><span>‘<samp class="samp">socket_perms = octal_mode</samp>’<a class="copiable-link" href="#index-socket_005fperms"> ¶</a></span></dt>
456 <dd><p>Permissions to set after creating the socket. This will override any
458 </p>
459 </dd>
460 <dt><a id="index-backlog"></a><span>‘<samp class="samp">backlog = integer</samp>’<a class="copiable-link" href="#index-backlog"> ¶</a></span></dt>
461 <dd><p>The number of connections to queue. When this limit is reached then new
463 </p>
464 </dd>
465 <dt><a id="index-invoking_005fuser"></a><span>‘<samp class="samp">invoking_user = [-!]user,[-!]@group,[-!]#SHA-256,…</samp>’<a class="copiable-link" href="#index-invoking_005fuser"> ¶</a></span></dt>
467 syntax is the same as the <code class="code">allowed</code> parameter except that it is a list of
468 local usernames, group names and <abbr class="acronym">TLS</abbr> fingerprint hashes that may use the
469 <code class="command">XPATH</code>, <code class="command">XPATHATTR</code> and <code class="command">DUMP</code> commands (except when
470 disabled with the <code class="code">disable_list_and_dump</code> option) and also who may modify
472 <code class="code">_acl</code>. It is similar to the system administrator root account but for a
473 data file and element paths (see <a class="pxref" href="#Access-Control">Access Control</a>). The default is specified
475 </p>
476 </dd>
477 <dt><a id="index-invoking_005ffile"></a><span>‘<samp class="samp">invoking_file = filename</samp>’<a class="copiable-link" href="#index-invoking_005ffile"> ¶</a></span></dt>
478 <dd><p>A file containing one entry per line. An entry has the same syntax as the
480 <code class="code">invoking_user</code> parameter are specified then the <code class="code">invoking_user</code>
483 </p>
484 </dd>
485 <dt><a id="index-strict_005fopen"></a><span>‘<samp class="samp">strict_open = boolean</samp>’<a class="copiable-link" href="#index-strict_005fopen"> ¶</a></span></dt>
486 <dd><p>When <code class="code">true</code>, disallow creation of a new data file when the current client
487 is not an <code class="code">invoking_user</code>. The default is <code class="code">false</code>.
488 </p>
489 </dd>
490 <dt><a id="index-strict_005fkill"></a><span>‘<samp class="samp">strict_kill = boolean</samp>’<a class="copiable-link" href="#index-strict_005fkill"> ¶</a></span></dt>
491 <dd><p>When <code class="code">false</code>, the <code class="code">KILL</code> command (see <a class="pxref" href="#KILL">Terminating another client.</a>) will allow killing
492 another client that is not of the same <code class="code">UID</code> or <abbr class="acronym">TLS</abbr> fingerprint of
495 </p>
496 </dd>
497 <dt><a id="index-allowed"></a><span>‘<samp class="samp">allowed = [-!]user,[-!]@group,[+,][-!]#SHA-256,[-!]/path/to/exec[…]</samp>’<a class="copiable-link" href="#index-allowed"> ¶</a></span></dt>
498 <dd><p>A comma separated list of local user names, group names or <abbr class="acronym">TLS</abbr>
499 fingerprint SHA-256 hashes (in the case of a remote client) which are
500 allowed to connect. Groups should be prefixed with a ‘<samp class="samp">@</samp>’. When not
502 the list may be prefixed with a <code class="code">-</code> or <code class="code">!</code> to prevent access. The
503 order of the list is important since a user may be a member of multiple
504 groups, for example.
505 </p>
506 <p>Connections from local clients may also be limited by command name. A command
507 name is the full path to the execuatble on the filesystem. The command check
508 is done after all other user and group name checks. When no command is
509 specified all commands are allowed. This feature is ignored when the
512 </p>
513 <p>This parameter may also be specified in a filename section to allow or deny a
514 client to <code class="code">OPEN</code> (see <a class="pxref" href="#OPEN">Opening a data file.</a>) a data file. It also affects the cache
515 commands <code class="code">CLEARCACHE</code> (see <a class="pxref" href="#CLEARCACHE">Removing a cache entry.</a>) and <code class="code">CACHETIMEOUT</code>
516 (see <a class="pxref" href="#CACHETIMEOUT">Setting the cache timeout.</a>). When not specified in a file section, any client
517 allowed to connect may also open any filename provided they can decrypt it.
520 </p>
522 allow <code class="code">username</code> who may be a member of <code class="code">primary</code>. It will also
523 allow any <abbr class="acronym">TLS</abbr> client except for the client with <abbr class="acronym">TLS</abbr>
524 fingerprint hash <code class="code">#ABCDEF</code>. For local connections, the connecting client
525 must be using the /usr/bin/pwmc program:
526 </p>
529 </pre></div>
531 </dd>
532 <dt><a id="index-allowed_005ffile"></a><span>‘<samp class="samp">allowed_file = filename</samp>’<a class="copiable-link" href="#index-allowed_005ffile"> ¶</a></span></dt>
533 <dd><p>A file containing one entry per line. An entry has the same syntax as the
538 </p>
539 </dd>
540 <dt><a id="index-encrypt_005fto"></a><span>‘<samp class="samp">encrypt_to = boolean</samp>’<a class="copiable-link" href="#index-encrypt_005fto"> ¶</a></span></dt>
541 <dd><p>When <code class="code">true</code> and <code class="command">SAVE</code>’ing a data file, allow <code class="command">gpg</code> to
542 append it’s configured key to the list of recipients. The default is
543 <code class="code">false</code> meaning that only keys specified with <code class="command">SAVE</code>
545 </p>
546 </dd>
547 <dt><a id="index-always_005ftrust"></a><span>‘<samp class="samp">always_trust = boolean</samp>’<a class="copiable-link" href="#index-always_005ftrust"> ¶</a></span></dt>
549 encryption keys. If you receive an error when <code class="command">SAVE</code>’ing stating that
550 the public key is unusable, either enable this option or edit the keys’ trust
551 value:
554 </pre></div>
556 </p>
557 </dd>
558 <dt><a id="index-gpg_005fhomedir"></a><span>‘<samp class="samp">gpg_homedir = path</samp>’<a class="copiable-link" href="#index-gpg_005fhomedir"> ¶</a></span></dt>
559 <dd><p>The location where <code class="command">gpg</code> will store its public and private keys and
560 configuration. The default is <samp class="file">HOMEDIR/.gnupg</samp> where <var class="var">HOMEDIR</var> is the
562 <samp class="option">--homedir</samp> command line option (see <a class="pxref" href="#Invoking">Invoking <code class="command">pwmd</code></a>). If you want to use
563 your standard <code class="command">gpg</code> keyring then set this to <samp class="file">~/.gnupg</samp>. Note
564 that a new instance of <code class="command">gpg-agent</code> will be started when <em class="emph">not</em>
565 using the standard keyring and that any configuration options for
568 </p>
569 </dd>
570 <dt><a id="index-disable_005fmlockall"></a><span>‘<samp class="samp">disable_mlockall = boolean</samp>’<a class="copiable-link" href="#index-disable_005fmlockall"> ¶</a></span></dt>
571 <dd><p>When set to <code class="code">false</code>, <cite class="cite">mlockall(2)</cite> will be called on startup. This
572 will use more physical memory but may also be more secure since no swapping to
575 </p>
576 </dd>
577 <dt><a id="index-log_005fpath"></a><span>‘<samp class="samp">log_path = /path/to/logfile</samp>’<a class="copiable-link" href="#index-log_005fpath"> ¶</a></span></dt>
578 <dd><p>Logs informational messages to the specified file. The default is
580 </p>
581 </dd>
582 <dt><a id="index-enable_005flogging"></a><span>‘<samp class="samp">enable_logging = boolean</samp>’<a class="copiable-link" href="#index-enable_005flogging"> ¶</a></span></dt>
583 <dd><p>Enable or disable logging to <var class="var">log_path</var>. The default is <code class="code">false</code>.
584 </p>
585 </dd>
586 <dt><a id="index-log_005fkeepopen"></a><span>‘<samp class="samp">log_keepopen = boolean</samp>’<a class="copiable-link" href="#index-log_005fkeepopen"> ¶</a></span></dt>
587 <dd><p>When set to <code class="code">false</code>, the log file specified with <var class="var">log_path</var> will be
589 </p>
590 </dd>
591 <dt><a id="index-syslog"></a><span>‘<samp class="samp">syslog = boolean</samp>’<a class="copiable-link" href="#index-syslog"> ¶</a></span></dt>
592 <dd><p>Enable logging to <cite class="cite">syslog(8)</cite> with facility <em class="emph">LOG_DAEMON</em> and priority
594 </p>
595 </dd>
596 <dt><a id="index-log_005flevel"></a><span>‘<samp class="samp">log_level = level</samp>’<a class="copiable-link" href="#index-log_005flevel"> ¶</a></span></dt>
597 <dd><p>When <code class="code">0</code>, only connections and errors are logged. When <code class="code">1</code>, data
598 file recipients and signers are logged during <code class="code">OPEN</code> (see <a class="pxref" href="#OPEN">Opening a data file.</a>) and
599 <code class="code">SAVE</code> (see <a class="pxref" href="#SAVE">Saving document changes to disk.</a>). When <code class="code">2</code>, client commands are also logged.
601 </p>
602 </dd>
603 <dt><a id="index-kill_005fscd"></a><span>‘<samp class="samp">kill_scd = boolean</samp>’<a class="copiable-link" href="#index-kill_005fscd"> ¶</a></span></dt>
604 <dd><p>Attempt to kill <code class="command">scdaemon</code> after a client disconnects. The default is
606 </p>
607 </dd>
608 <dt><a id="index-disable_005flist_005fand_005fdump"></a><span>‘<samp class="samp">disable_list_and_dump = boolean</samp>’<a class="copiable-link" href="#index-disable_005flist_005fand_005fdump"> ¶</a></span></dt>
609 <dd><p>When <code class="code">true</code> the <code class="code">XPATH</code>, <code class="code">XPATHATTR</code>, <code class="code">LIST</code> and
610 <code class="code">DUMP</code> protocol commands (see <a class="pxref" href="#Commands">Protocol commands and their syntax</a>) will be disabled.
611 </p>
612 </dd>
613 <dt><a id="index-cache_005fpush"></a><span>‘<samp class="samp">cache_push = file1,file2</samp>’<a class="copiable-link" href="#index-cache_005fpush"> ¶</a></span></dt>
614 <dd><p>A comma separated list of filenames to be cached upon startup. <code class="command">pwmd</code>
615 will prompt for the passphrase for each file unless specified with
617 </p>
618 </dd>
619 <dt><a id="index-priority"></a><span>‘<samp class="samp">priority = integer</samp>’<a class="copiable-link" href="#index-priority"> ¶</a></span></dt>
620 <dd><p>The priority or niceness of the server. The default is inherited from the
621 parent process.
622 </p>
623 </dd>
624 <dt><a id="index-lock_005ftimeout"></a><span>‘<samp class="samp">lock_timeout = integer</samp>’<a class="copiable-link" href="#index-lock_005ftimeout"> ¶</a></span></dt>
625 <dd><p>The default timeout in tenths of a second before giving up while waiting for a
627 </p>
628 </dd>
629 </dl>
632 <p>The following options are defaults for new files when specified in the
633 ‘<samp class="samp">global</samp>’ section. When placed in a data file section they are options
634 specific to that data file only.
635 </p>
637 <dt><a id="index-require_005fsave_005fkey"></a><span>‘<samp class="samp">require_save_key = boolean</samp>’<a class="copiable-link" href="#index-require_005fsave_005fkey"> ¶</a></span></dt>
638 <dd><p>Require the passphrase needed for signing before writing changes of the
639 document to disk regardless of the key cache status. The default is
640 <code class="code">true</code>. This option compliments <code class="command">gpg-agent</code> option
642 </p>
643 </dd>
644 <dt><a id="index-backup"></a><span>‘<samp class="samp">backup = boolean</samp>’<a class="copiable-link" href="#index-backup"> ¶</a></span></dt>
645 <dd><p>Whether to create a backup of the data file when saving. The backup filename
648 </p>
649 </dd>
650 <dt><a id="index-cache_005ftimeout"></a><span>‘<samp class="samp">cache_timeout = seconds</samp>’<a class="copiable-link" href="#index-cache_005ftimeout"> ¶</a></span></dt>
651 <dd><p>The number of seconds to keep the cache entry for this file. If <code class="code">-1</code>, the
653 <code class="code">OPEN</code>ed (see <a class="pxref" href="#OPEN">Opening a data file.</a>) a passphrase will be required. The default
655 </p>
656 </dd>
657 <dt><a id="index-passphrase_005ffile"></a><span>‘<samp class="samp">passphrase_file = /path/to/filename</samp>’<a class="copiable-link" href="#index-passphrase_005ffile"> ¶</a></span></dt>
658 <dd><p>Obtain the passphrase to open the data file from <var class="var">filename</var>. If specified
659 in the ‘<samp class="samp">global</samp>’ section then the <var class="var">passphrase_file</var> is a default for
660 all data files. Note that if a client changes the passphrase for this data
662 passphrase.
663 </p>
664 </dd>
665 <dt><a id="index-recursion_005fdepth"></a><span>‘<samp class="samp">recursion_depth = integer</samp>’<a class="copiable-link" href="#index-recursion_005fdepth"> ¶</a></span></dt>
666 <dd><p>The maximum number of times to resolve a <code class="code">_target</code> attribute for an
667 element in an element path (see <a class="pxref" href="#Target-Attribute">The <code class="code">target</code> attribute</a>). An error is returned
668 when this value is exceeded. The default is <code class="code">100</code> but can be disabled by
670 </p>
671 </dd>
672 <dt>‘<samp class="samp">allowed = [-]user,[-]@group,[!]#TLSFINGERPRINT,…</samp>’</dt>
673 <dd><p>Same parameter value as the <code class="code">allowed</code> parameter mentioned above in
674 the ‘<samp class="samp">[global]</samp>’ section but grants or denies a client from opening a
675 specific data file. The default is to allow any client that is allowed to
676 connect.
677 </p>
678 </dd>
679 </dl>
681 <hr>
682 </div>
685 <p>
686 Next: <a href="#Pinentry" accesskey="n" rel="next">Pinentry configuration</a>, Previous: <a href="#Configuration" accesskey="p" rel="prev"><code class="command">pwmd</code> configuration file options</a>, Up: <a href="#Configuration" accesskey="u" rel="up"><code class="command">pwmd</code> configuration file options</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
687 </div>
688 <h2 class="chapter" id="Configuring-remote-connections-over-TLS_002e"><span>6 Configuring remote connections over TLS.<a class="copiable-link" href="#Configuring-remote-connections-over-TLS_002e"> ¶</a></span></h2>
689 <p>In addition to connecting to <code class="command">pwmd</code> via a Unix Domain Socket, remote
690 connections can also be made to <code class="command">pwmd</code> over <abbr class="acronym">TLS</abbr>.
691 Authentication is done by using X.509 client certificates that are signed with
692 the same Certificate Authority (CA) as the server certificate.
693 </p>
694 <p>The CA certificate is expected to be found in
695 <samp class="file">~/.pwmd/ca-cert.pem</samp> while the <code class="command">pwmd</code> server certificate and key
698 </p>
699 <p>See the documentation of <code class="command">certtool</code> or <code class="command">openssl</code> for details
700 about creating self-signed certificates.
701 </p>
703 </p>
705 <dt><a id="index-enable_005ftcp"></a><span>‘<samp class="samp">enable_tcp = boolean</samp>’<a class="copiable-link" href="#index-enable_005ftcp"> ¶</a></span></dt>
706 <dd><p>Whether to enable <abbr class="acronym">TCP</abbr>/<abbr class="acronym">TLS</abbr> server support. If enabled, both <abbr class="acronym">TCP</abbr> and the local
707 unix domain socket will listen for connections. The default is
709 </p>
710 </dd>
711 <dt><a id="index-tcp_005fport"></a><span>‘<samp class="samp">tcp_port = integer</samp>’<a class="copiable-link" href="#index-tcp_005fport"> ¶</a></span></dt>
712 <dd><p>The <abbr class="acronym">TCP</abbr> port to listen on when <var class="var">enable_tcp</var> is <code class="code">true</code>. The default is
714 </p>
715 </dd>
716 <dt><a id="index-tcp_005fbind"></a><span>‘<samp class="samp">tcp_bind = string</samp>’<a class="copiable-link" href="#index-tcp_005fbind"> ¶</a></span></dt>
717 <dd><p>The internet protocol to listen with. Must be one of <code class="code">ipv4</code>, <code class="code">ipv6</code>
720 </p>
721 </dd>
722 <dt><a id="index-tcp_005finterface"></a><span>‘<samp class="samp">tcp_interface = string</samp>’<a class="copiable-link" href="#index-tcp_005finterface"> ¶</a></span></dt>
723 <dd><p>Only useful if running as root.
724 </p>
725 </dd>
726 <dt><a id="index-tls_005ftimeout"></a><span>‘<samp class="samp">tls_timeout = seconds</samp>’<a class="copiable-link" href="#index-tls_005ftimeout"> ¶</a></span></dt>
727 <dd><p>The number of seconds to wait for a read() or write() call on a
730 </p>
731 </dd>
732 <dt><a id="index-keepalive_005finterval"></a><span>‘<samp class="samp">keepalive_interval = seconds</samp>’<a class="copiable-link" href="#index-keepalive_005finterval"> ¶</a></span></dt>
733 <dd><p>Send a keepalive status message to an idle remote client. An idle
734 client is one that is not in a command. The purpose of this status
735 message is to disconnect a hung remote client and release any file mutex
736 locks so another client may open the same data file. The default is <code class="code">60</code>.
737 </p>
738 </dd>
739 <dt><a id="index-tcp_005frequire_005fkey"></a><span>‘<samp class="samp">tcp_require_key = boolean</samp>’<a class="copiable-link" href="#index-tcp_005frequire_005fkey"> ¶</a></span></dt>
740 <dd><p>When <code class="code">true</code>, require the remote client to provide the passphrase to open
741 a data file even if the file is cached. This option is a default for all
742 files when specified in the ‘<samp class="samp">[global]</samp>’ section. The default is
744 </p>
745 </dd>
746 <dt><a id="index-tls_005fcipher_005fsuite"></a><span>‘<samp class="samp">tls_cipher_suite = string</samp>’<a class="copiable-link" href="#index-tls_005fcipher_005fsuite"> ¶</a></span></dt>
747 <dd><p>The GnuTLS cipher suite and protocol to use. See the GnuTLS documentation for
748 information about the format of this string. The default is
749 <code class="code">SECURE256:SECURE192:SECURE128:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1:-AES-128-CBC:-AES-256-CBC</code>.
750 </p>
751 </dd>
752 <dt><a id="index-tls_005fdh_005fparams_005ffile"></a><span>‘<samp class="samp">tls_dh_params_file = filename</samp>’<a class="copiable-link" href="#index-tls_005fdh_005fparams_005ffile"> ¶</a></span></dt>
753 <dd><p>The PEM encoded filename containing DH parameters. If not specified
754 then DH algorithms will not be available to the client. See the
755 <code class="command">openssl dhparam</code> or <code class="command">certtool</code> manual pages for details about
756 generating this file.
757 </p>
758 <p>Note that SIGHUP will not reload this file once <abbr class="acronym">TLS</abbr> support has been enabled.
760 </p>
761 </dd>
762 <dt><a id="index-tls_005fuse_005fcrl"></a><span>‘<samp class="samp">tls_use_crl = boolean</samp>’<a class="copiable-link" href="#index-tls_005fuse_005fcrl"> ¶</a></span></dt>
763 <dd><p>When <code class="code">true</code>, enable the use of <samp class="option">tls_crl_file</samp>. The default is
765 </p>
766 </dd>
767 <dt><a id="index-tls_005fcrl_005ffile"></a><span>‘<samp class="samp">tls_crl_file = filename</samp>’<a class="copiable-link" href="#index-tls_005fcrl_005ffile"> ¶</a></span></dt>
768 <dd><p>This file is an X.509 Certificate Revocation List (<abbr class="acronym">CRL</abbr>) and can be
769 used to deny clients by adding client certificates to it. <code class="command">pwmd</code> will
770 need to be restarted to recognize any changes to this file. When not
773 </p>
774 </dd>
775 <dt><a id="index-tls_005fca_005ffile"></a><span>‘<samp class="samp">tls_ca_file = filename</samp>’<a class="copiable-link" href="#index-tls_005fca_005ffile"> ¶</a></span></dt>
776 <dd><p>The filename of the <abbr class="acronym">CA</abbr> certificate to use. When not specified the
778 </p>
779 </dd>
780 <dt><a id="index-tls_005fserver_005fcert_005ffile"></a><span>‘<samp class="samp">tls_server_cert_file = filename</samp>’<a class="copiable-link" href="#index-tls_005fserver_005fcert_005ffile"> ¶</a></span></dt>
781 <dd><p>The filename of the server certificate to use. When not specified the default
783 </p>
784 </dd>
785 <dt><a id="index-tls_005fserver_005fkey_005ffile"></a><span>‘<samp class="samp">tls_server_key_file = filename</samp>’<a class="copiable-link" href="#index-tls_005fserver_005fkey_005ffile"> ¶</a></span></dt>
786 <dd><p>The key filename of the server certificate to use. When not specified the
788 </p>
789 </dd>
790 </dl>
792 <hr>
793 </div>
796 <p>
797 Next: <a href="#Commands" accesskey="n" rel="next">Protocol commands and their syntax</a>, Previous: <a href="#TLS" accesskey="p" rel="prev">Configuring remote connections over TLS.</a>, Up: <a href="#Configuration" accesskey="u" rel="up"><code class="command">pwmd</code> configuration file options</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
798 </div>
799 <h2 class="chapter" id="Pinentry-configuration"><span>7 Pinentry configuration<a class="copiable-link" href="#Pinentry-configuration"> ¶</a></span></h2>
802 input or as a confirmation dialog; it needs to know where to prompt for
803 the input; from a terminal or an X11 display.
804 </p>
805 <p>It is the responsibility of the client to tell <code class="command">pinentry</code> about the
806 terminal or X11 display before requiring the input. This is done with the
807 <code class="command">OPTION</code> command (see <a class="pxref" href="#OPTION">Setting various client parameters.</a>) to either set or unset needed
809 <code class="command">gpg-connect-agent</code> program. Please read it’s documentation about the
811 </p>
812 <hr>
813 </div>
816 <p>
817 Next: <a href="#Bulk-Commands" accesskey="n" rel="next">Running multiple commands in sequence</a>, Previous: <a href="#Pinentry" accesskey="p" rel="prev">Pinentry configuration</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
818 </div>
819 <h2 class="chapter" id="Protocol-commands-and-their-syntax"><span>8 Protocol commands and their syntax<a class="copiable-link" href="#Protocol-commands-and-their-syntax"> ¶</a></span></h2>
855 </ul>
856 <hr>
859 <p>
860 Next: <a href="#BULK" accesskey="n" rel="next">Run a series of commands in sequence.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
861 </div>
862 <h3 class="section" id="Modifying-element-attributes_002e"><span>8.1 Modifying element attributes.<a class="copiable-link" href="#Modifying-element-attributes_002e"> ¶</a></span></h3>
864 <p>Syntax:
866 <pre class="example-preformatted">ATTR [--inquire] SET|GET|DELETE|LIST [<attribute>] element[<TAB>child[..]] ..
867 </pre></div>
871 <dd><p>Stores or updates an <var class="var">attribute</var> name and optional <var class="var">value</var> of an
873 <br><br>
874 </p></dd>
876 <dd><p>Removes an attribute from an element. If <var class="var">attribute</var> is <code class="code">_name</code>
877 or <code class="code">target</code> an error is returned. Use the <code class="command">DELETE</code> command
879 <br><br>
880 </p></dd>
882 <dd><p>Retrieves a newline separated list of attributes names and values
883 from the specified element. Each attribute name and value is space delimited.
884 <br><br>
885 </p></dd>
888 </p></dd>
889 </dl>
890 <br><br>
891 <p>When the <samp class="option">--inquire</samp> option is passed then all remaining non-option
893 <br><br>
894 See <a class="xref" href="#Target-Attribute">The <code class="code">target</code> attribute</a>, for details about this special attribute and also
895 see <a class="pxref" href="#Other-Attributes">Other special attributes</a> for other attributes that are handled specially
897 </p>
899 <hr>
900 </div>
903 <p>
904 Next: <a href="#CACHETIMEOUT" accesskey="n" rel="next">Setting the cache timeout.</a>, Previous: <a href="#ATTR" accesskey="p" rel="prev">Modifying element attributes.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
905 </div>
906 <h3 class="section" id="Run-a-series-of-commands-in-sequence_002e"><span>8.2 Run a series of commands in sequence.<a class="copiable-link" href="#Run-a-series-of-commands-in-sequence_002e"> ¶</a></span></h3>
908 <p>Syntax:
911 </pre></div>
913 <p>Parses a semi-canonical s-expression representing a series of protocol
914 commands to be run in sequence (see <a class="pxref" href="#Bulk-Commands">Running multiple commands in sequence</a>). Returns a canonical
915 s-expression containing each commands id, return value and result data
916 (if any).
917 <br><br>
920 </p>
922 <hr>
923 </div>
926 <p>
927 Next: <a href="#CLEARCACHE" accesskey="n" rel="next">Removing a cache entry.</a>, Previous: <a href="#BULK" accesskey="p" rel="prev">Run a series of commands in sequence.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
928 </div>
929 <h3 class="section" id="Setting-the-cache-timeout_002e"><span>8.3 Setting the cache timeout.<a class="copiable-link" href="#Setting-the-cache-timeout_002e"> ¶</a></span></h3>
931 <p>Syntax:
934 </pre></div>
938 <code class="code">0</code> will require the passphrase for each <code class="code">OPEN</code> command
939 (see <a class="pxref" href="#OPEN">Opening a data file.</a>) or <code class="code">SAVE</code> (see <a class="pxref" href="#SAVE">Saving document changes to disk.</a>) command. See <a class="xref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>,
941 </p>
943 <hr>
944 </div>
947 <p>
948 Next: <a href="#COPY" accesskey="n" rel="next">Copying an element.</a>, Previous: <a href="#CACHETIMEOUT" accesskey="p" rel="prev">Setting the cache timeout.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
949 </div>
950 <h3 class="section" id="Removing-a-cache-entry_002e"><span>8.4 Removing a cache entry.<a class="copiable-link" href="#Removing-a-cache-entry_002e"> ¶</a></span></h3>
952 <p>Syntax:
955 </pre></div>
957 <p>Clears a file cache entry for all or the specified <var class="var">filename</var>. Note that
960 <br><br>
961 When clearing all cache entries a permissions test is done against the
964 returned depending on cached data files and client permissions.
965 </p>
967 <hr>
968 </div>
971 <p>
972 Next: <a href="#DELETE" accesskey="n" rel="next">Deleting an element.</a>, Previous: <a href="#CLEARCACHE" accesskey="p" rel="prev">Removing a cache entry.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
973 </div>
974 <h3 class="section" id="Copying-an-element_002e"><span>8.5 Copying an element.<a class="copiable-link" href="#Copying-an-element_002e"> ¶</a></span></h3>
976 <p>Syntax:
978 <pre class="example-preformatted">COPY [--inquire] source[<TAB>child[..]] dest[<TAB>child[..]]
979 </pre></div>
981 <p>Copies the entire element tree starting from the child node of the source
982 element, to the destination element path. If the destination element path
983 does not exist then it will be created; otherwise it is overwritten.
984 <br><br>
985 Note that attributes from the source element are merged into the
986 destination element when the destination element path exists. When an
987 attribute of the same name exists in both the source and destination
988 elements then the destination attribute will be updated to the source
989 attribute value.
990 <br><br>
993 </p>
995 <hr>
996 </div>
999 <p>
1000 Next: <a href="#DELETEKEY" accesskey="n" rel="next">Deleting a key from the key ring.</a>, Previous: <a href="#COPY" accesskey="p" rel="prev">Copying an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1001 </div>
1002 <h3 class="section" id="Deleting-an-element_002e"><span>8.6 Deleting an element.<a class="copiable-link" href="#Deleting-an-element_002e"> ¶</a></span></h3>
1004 <p>Syntax:
1007 </pre></div>
1009 <p>Removes the specified element path and all of its children. This may break
1010 an element with a <code class="code">target</code> attribute (see <a class="pxref" href="#Target-Attribute">The <code class="code">target</code> attribute</a>) that
1011 refers to this element or any of its children.
1012 <br><br>
1015 </p>
1017 <hr>
1018 </div>
1021 <p>
1022 Next: <a href="#DUMP" accesskey="n" rel="next">Showing the XML document.</a>, Previous: <a href="#DELETE" accesskey="p" rel="prev">Deleting an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1023 </div>
1024 <h3 class="section" id="Deleting-a-key-from-the-key-ring_002e"><span>8.7 Deleting a key from the key ring.<a class="copiable-link" href="#Deleting-a-key-from-the-key-ring_002e"> ¶</a></span></h3>
1026 <p>Syntax:
1029 </pre></div>
1033 data file.
1034 Note that no confirmation occurs. Also note that when the key is deleted,
1035 the current or other data files using this key will no longer be able to be
1036 opened.
1037 </p>
1039 <hr>
1040 </div>
1043 <p>
1044 Next: <a href="#GENKEY" accesskey="n" rel="next">Generating a new key.</a>, Previous: <a href="#DELETEKEY" accesskey="p" rel="prev">Deleting a key from the key ring.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1045 </div>
1046 <h3 class="section" id="Showing-the-XML-document_002e"><span>8.8 Showing the XML document.<a class="copiable-link" href="#Showing-the-XML-document_002e"> ¶</a></span></h3>
1048 <p>Syntax:
1051 </pre></div>
1053 <p>Shows the in memory <abbr class="abbr">XML</abbr> document with indenting. See <a class="xref" href="#XPATH">Modifying more than one element.</a>, for
1054 dumping a specific node.
1055 </p>
1057 <hr>
1058 </div>
1061 <p>
1062 Next: <a href="#GET" accesskey="n" rel="next">Getting the content of an element.</a>, Previous: <a href="#DUMP" accesskey="p" rel="prev">Showing the XML document.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1063 </div>
1064 <h3 class="section" id="Generating-a-new-key_002e"><span>8.9 Generating a new key.<a class="copiable-link" href="#Generating-a-new-key_002e"> ¶</a></span></h3>
1066 <p>Syntax:
1068 <pre class="example-preformatted">GENKEY --subkey-of=fpr | --userid="str" [--no-expire | --expire=N] [--algo="str"] [--no-passphrase] [--usage="default|sign|encrypt"]
1069 </pre></div>
1071 <p>Generates a new key based on option arguments. One of
1073 required. The <samp class="option">--subkey-of</samp> option will generate a subkey for the key
1074 of the specified fingerprint.
1075 <br><br>
1076 Note that this may take a long time to complete especially if you do not
1077 have a hardware RNG. There are software RNG’s that will speed this up
1078 but are also not as secure.
1079 </p>
1081 <hr>
1082 </div>
1085 <p>
1086 Next: <a href="#GETCONFIG" accesskey="n" rel="next">Obtaining a configuration value.</a>, Previous: <a href="#GENKEY" accesskey="p" rel="prev">Generating a new key.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1087 </div>
1088 <h3 class="section" id="Getting-the-content-of-an-element_002e"><span>8.10 Getting the content of an element.<a class="copiable-link" href="#Getting-the-content-of-an-element_002e"> ¶</a></span></h3>
1090 <p>Syntax:
1093 </pre></div>
1095 <p>Retrieves the content of the specified element. The content is returned
1096 with a data response.
1097 <br><br>
1100 </p>
1102 <hr>
1103 </div>
1106 <p>
1107 Next: <a href="#GETINFO" accesskey="n" rel="next">Obtaining server and client information.</a>, Previous: <a href="#GET" accesskey="p" rel="prev">Getting the content of an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1108 </div>
1109 <h3 class="section" id="Obtaining-a-configuration-value_002e"><span>8.11 Obtaining a configuration value.<a class="copiable-link" href="#Obtaining-a-configuration-value_002e"> ¶</a></span></h3>
1111 <p>Syntax:
1114 </pre></div>
1116 <p>Returns the value of a <code class="command">pwmd</code> configuration <var class="var">parameter</var> with a
1120 set with the <code class="code">OPTION</code> command (see <a class="pxref" href="#OPTION">Setting various client parameters.</a>) will be returned.
1121 </p>
1123 <hr>
1124 </div>
1127 <p>
1128 Next: <a href="#HELP" accesskey="n" rel="next">Showing available commands.</a>, Previous: <a href="#GETCONFIG" accesskey="p" rel="prev">Obtaining a configuration value.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1129 </div>
1130 <h3 class="section" id="Obtaining-server-and-client-information_002e"><span>8.12 Obtaining server and client information.<a class="copiable-link" href="#Obtaining-server-and-client-information_002e"> ¶</a></span></h3>
1132 <p>Syntax:
1134 <pre class="example-preformatted">GETINFO [--data] [--verbose] CACHE | CLIENTS | PID | USER | LAST_ERROR | VERSION
1135 </pre></div>
1137 <p>Get server and other information. The information is returned via a status
1138 message (see <a class="pxref" href="#Status-Messages">Status messages and their meanings</a>) unless otherwise noted or <samp class="option">--data</samp>
1139 is specified.
1140 <br><br>
1142 <br><br>
1144 connected clients via a status message or a list of connected clients when
1145 the <samp class="option">--verbose</samp> parameter is used (implies <samp class="option">--data</samp>). A
1146 verbose line of a client list contains
1147 space delimited
1149 IP address if remote, file lock status, whether the current client is self
1150 or not, client state (see below),
1151 user ID or TLS fingerprint of the connected client, username if the
1153 client connected.
1154 <br><br>
1155 Client state <code class="code">0</code> is an unknown client state, state <code class="code">1</code> indicates
1156 the client has connected but hasn’t completed initializing, state <code class="code">2</code>
1158 client is in a command and state <code class="code">4</code> means the client is disconnecting.
1159 <br><br>
1161 <br><br>
1163 via a data response with each being space delimited.
1164 <br><br>
1166 via a data response, when available.
1167 <br><br>
1168 <var class="var">USER</var> returns the username or <abbr class="abbr">TLS</abbr> hash of the connected client
1169 via a data response.
1170 </p>
1172 <hr>
1173 </div>
1176 <p>
1177 Next: <a href="#IMPORT" accesskey="n" rel="next">Creating elements from XML.</a>, Previous: <a href="#GETINFO" accesskey="p" rel="prev">Obtaining server and client information.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1178 </div>
1179 <h3 class="section" id="Showing-available-commands_002e"><span>8.13 Showing available commands.<a class="copiable-link" href="#Showing-available-commands_002e"> ¶</a></span></h3>
1181 <p>Syntax:
1184 </pre></div>
1186 <p>Show available commands or command specific help text.
1187 <br><br>
1189 </p>
1191 <hr>
1192 </div>
1195 <p>
1196 Next: <a href="#ISCACHED" accesskey="n" rel="next">Testing cache status.</a>, Previous: <a href="#HELP" accesskey="p" rel="prev">Showing available commands.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1197 </div>
1198 <h3 class="section" id="Creating-elements-from-XML_002e"><span>8.14 Creating elements from XML.<a class="copiable-link" href="#Creating-elements-from-XML_002e"> ¶</a></span></h3>
1200 <p>Syntax:
1203 </pre></div>
1206 <br><br>
1207 Like the <code class="code">STORE</code> command (see <a class="pxref" href="#STORE">Modifying the content of an element.</a>), but the <var class="var">content</var>
1210 document root when not specified. Existing elements of the same name will
1211 be overwritten.
1212 <br><br>
1213 The content must begin with an <abbr class="abbr">XML</abbr> element node. See <a class="xref" href="#Introduction">Overview of <code class="command">pwmd</code></a>,
1214 for details.
1215 </p>
1217 <hr>
1218 </div>
1221 <p>
1222 Next: <a href="#KEYINFO" accesskey="n" rel="next">Showing keys used for the current data file.</a>, Previous: <a href="#IMPORT" accesskey="p" rel="prev">Creating elements from XML.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1223 </div>
1224 <h3 class="section" id="Testing-cache-status_002e"><span>8.15 Testing cache status.<a class="copiable-link" href="#Testing-cache-status_002e"> ¶</a></span></h3>
1226 <p>Syntax:
1229 </pre></div>
1232 The default is to test whether the filename is cached in memory. Passing
1233 option <samp class="option">--agent</samp> will test the <code class="command">gpg-agent</code> cache for at most
1234 one cached key used for opening the data file (see <a class="pxref" href="#OPEN">Opening a data file.</a>). To test if
1235 a signing key is cached, pass <samp class="option">--sign</samp> along with <samp class="option">--agent</samp>.
1236 Both the <samp class="option">--agent</samp> and <samp class="option">--sign</samp> options require an opened data
1237 file.
1238 <br><br>
1239 An <em class="emph">OK</em> response is returned if the specified <var class="var">filename</var> is found
1240 in the cache. If not found in the cache but exists on the filesystem
1242 returned.
1243 <br><br>
1244 The <samp class="option">--lock</samp> option will lock the file mutex of <var class="var">filename</var> when
1245 the file exists; it does not need to be opened nor cached. The lock will be
1247 (see <a class="pxref" href="#UNLOCK">Removing a data file lock.</a>). When this option is passed the current data file is closed.
1248 </p>
1250 <hr>
1251 </div>
1254 <p>
1255 Next: <a href="#KILL" accesskey="n" rel="next">Terminating another client.</a>, Previous: <a href="#ISCACHED" accesskey="p" rel="prev">Testing cache status.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1256 </div>
1257 <h3 class="section" id="Showing-keys-used-for-the-current-data-file_002e"><span>8.16 Showing keys used for the current data file.<a class="copiable-link" href="#Showing-keys-used-for-the-current-data-file_002e"> ¶</a></span></h3>
1259 <p>Syntax:
1262 </pre></div>
1265 data file has recipients and signers for. If the key is a signing key it
1267 signers in the case of being symmetrically encrypted, the error code
1269 <br><br>
1271 imported.
1272 </p>
1274 <hr>
1275 </div>
1278 <p>
1279 Next: <a href="#LIST" accesskey="n" rel="next">Showing document elements.</a>, Previous: <a href="#KEYINFO" accesskey="p" rel="prev">Showing keys used for the current data file.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1280 </div>
1281 <h3 class="section" id="Terminating-another-client_002e"><span>8.17 Terminating another client.<a class="copiable-link" href="#Terminating-another-client_002e"> ¶</a></span></h3>
1283 <p>Syntax:
1286 </pre></div>
1289 lock or other resources it has held. See <code class="code">GETINFO</code> (see <a class="pxref" href="#GETINFO">Obtaining server and client information.</a>)
1291 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) may kill any client while others may only kill
1292 clients of the same <code class="code">UID</code> or <abbr class="abbr">TLS</abbr> fingerprint.
1293 </p>
1295 <hr>
1296 </div>
1299 <p>
1300 Next: <a href="#LISTKEYS" accesskey="n" rel="next">Listing keys in the key ring.</a>, Previous: <a href="#KILL" accesskey="p" rel="prev">Terminating another client.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1301 </div>
1302 <h3 class="section" id="Showing-document-elements_002e"><span>8.18 Showing document elements.<a class="copiable-link" href="#Showing-document-elements_002e"> ¶</a></span></h3>
1304 <p>Syntax:
1306 <pre class="example-preformatted">LIST [--inquire] [--recurse] [--sexp] [element[<TAB>child[..]]]
1307 </pre></div>
1309 <p>If no element path is given then a newline separated list of root elements
1310 is returned with a data response. If given, then children of the specified
1311 element path are returned.
1312 <br><br>
1313 Each element path
1314 returned will have zero or more flags appened to it. These flags are
1315 delimited from the element path by a single space character. A flag itself
1320 <code class="code">O</code> indicates that a <var class="var">target</var> attribute recursion limit was reached
1321 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>). Flag <code class="code">T</code>, followed by a single space character,
1323 contained in the current element.
1324 <br><br>
1325 When a specified element path contains an error either from the final
1326 element in the path or any previous element, the path is still shown but
1327 will contain the error flag for the element with the error. Determining
1328 the actual element which contains the error is up to the client. This can be
1329 done by traversing the final element up to parent elements that contain the
1330 same error flag.
1331 <br><br>
1333 for a specified element path or the entire tree for all root elements.
1334 <br><br>
1336 appends an elements’ attributes and attribute values. The syntax is:
1337 </p>
1342 )
1343 ...
1344 )
1345 </pre></div>
1347 <p>When the <samp class="option">--inquire</samp> option is passed then all remaining non-option
1349 </p>
1351 <hr>
1352 </div>
1355 <p>
1356 Next: <a href="#LOCK" accesskey="n" rel="next">Locking the current data file.</a>, Previous: <a href="#LIST" accesskey="p" rel="prev">Showing document elements.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1357 </div>
1358 <h3 class="section" id="Listing-keys-in-the-key-ring_002e"><span>8.19 Listing keys in the key ring.<a class="copiable-link" href="#Listing-keys-in-the-key-ring_002e"> ¶</a></span></h3>
1360 <p>Syntax:
1363 </pre></div>
1365 <p>Returns a new line separated list of key information matching a comma
1366 separated list of <var class="var">pattern</var>’s. When option <samp class="option">--secret-only</samp> is
1368 available will be returned.
1369 </p>
1371 <hr>
1372 </div>
1375 <p>
1376 Next: <a href="#LS" accesskey="n" rel="next">Showing available data files.</a>, Previous: <a href="#LISTKEYS" accesskey="p" rel="prev">Listing keys in the key ring.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1377 </div>
1378 <h3 class="section" id="Locking-the-current-data-file_002e"><span>8.20 Locking the current data file.<a class="copiable-link" href="#Locking-the-current-data-file_002e"> ¶</a></span></h3>
1380 <p>Syntax:
1383 </pre></div>
1385 <p>Locks the mutex associated with the opened file. This prevents other clients
1386 from sending commands to the same opened file until the client
1389 </p>
1391 <hr>
1392 </div>
1395 <p>
1396 Next: <a href="#MOVE" accesskey="n" rel="next">Moving an element.</a>, Previous: <a href="#LOCK" accesskey="p" rel="prev">Locking the current data file.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1397 </div>
1398 <h3 class="section" id="Showing-available-data-files_002e"><span>8.21 Showing available data files.<a class="copiable-link" href="#Showing-available-data-files_002e"> ¶</a></span></h3>
1400 <p>Syntax:
1403 </pre></div>
1405 <p>Returns a newline separated list of data files stored in the data directory
1406 <samp class="file">HOMEDIR/data</samp> (see <a class="pxref" href="#Invoking">Invoking <code class="command">pwmd</code></a>) with a data response. When the
1408 access, modification and change times are appended to the line.
1409 </p>
1411 <hr>
1412 </div>
1415 <p>
1416 Next: <a href="#NOP" accesskey="n" rel="next">Testing the connection.</a>, Previous: <a href="#LS" accesskey="p" rel="prev">Showing available data files.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1417 </div>
1418 <h3 class="section" id="Moving-an-element_002e"><span>8.22 Moving an element.<a class="copiable-link" href="#Moving-an-element_002e"> ¶</a></span></h3>
1420 <p>Syntax:
1422 <pre class="example-preformatted">MOVE [--inquire] source[<TAB>child[..]] [dest[<TAB>child[..]]]
1423 </pre></div>
1425 <p>Moves the source element path to the destination element path. If the
1426 destination is not specified then it will be moved to the root node of the
1427 document. If the destination is specified and exists then it will be
1428 overwritten; otherwise non-existing elements of the destination element
1429 path will be created.
1430 <br><br>
1433 </p>
1435 <hr>
1436 </div>
1439 <p>
1440 Next: <a href="#OPEN" accesskey="n" rel="next">Opening a data file.</a>, Previous: <a href="#MOVE" accesskey="p" rel="prev">Moving an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1441 </div>
1442 <h3 class="section" id="Testing-the-connection_002e"><span>8.23 Testing the connection.<a class="copiable-link" href="#Testing-the-connection_002e"> ¶</a></span></h3>
1444 <p>Syntax:
1447 </pre></div>
1449 <p>This command does nothing. It is useful for testing the connection for a
1450 timeout condition.
1451 </p>
1453 <hr>
1454 </div>
1457 <p>
1458 Next: <a href="#OPTION" accesskey="n" rel="next">Setting various client parameters.</a>, Previous: <a href="#NOP" accesskey="p" rel="prev">Testing the connection.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1459 </div>
1460 <h3 class="section" id="Opening-a-data-file_002e"><span>8.24 Opening a data file.<a class="copiable-link" href="#Opening-a-data-file_002e"> ¶</a></span></h3>
1462 <p>Syntax:
1465 </pre></div>
1467 <p>Opens <var class="var">filename</var>. When the <var class="var">filename</var> is not found on the
1468 file-system then a new in-memory document will be created. If the file is
1469 found, it is looked for in the file cache and when found no passphrase will
1472 (see <a class="pxref" href="#OPTION">Setting various client parameters.</a>) was specified in which case <code class="command">pwmd</code> will
1476 not exist.
1477 <br><br>
1479 locked as if the <code class="code">LOCK</code> command (see <a class="pxref" href="#LOCK">Locking the current data file.</a>) had been sent after the
1480 file had been opened.
1481 </p>
1483 <hr>
1484 </div>
1487 <p>
1488 Next: <a href="#PASSWD" accesskey="n" rel="next">Changing the passphrase for a key.</a>, Previous: <a href="#OPEN" accesskey="p" rel="prev">Opening a data file.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1489 </div>
1490 <h3 class="section" id="Setting-various-client-parameters_002e"><span>8.25 Setting various client parameters.<a class="copiable-link" href="#Setting-various-client-parameters_002e"> ¶</a></span></h3>
1492 <p>Syntax:
1495 </pre></div>
1497 <p>Sets a client option <var class="var">name</var> to <var class="var">value</var>. The value for an option is
1498 kept for the duration of the connection with the exception of the
1500 (see <a class="pxref" href="#Pinentry">Pinentry configuration</a>). When <var class="var">value</var> is empty the option is unset.
1501 <br><br>
1504 <dd><p>Disable use of <code class="command">pinentry</code> for passphrase retrieval. When <code class="code">1</code>, a
1505 server inquire is sent to the client to obtain the passphrase. This option
1506 may be set as needed before the <code class="code">OPEN</code> (see <a class="pxref" href="#OPEN">Opening a data file.</a>), <code class="code">PASSWD</code>
1507 (see <a class="pxref" href="#PASSWD">Changing the passphrase for a key.</a>) and <code class="code">SAVE</code> (see <a class="pxref" href="#SAVE">Saving document changes to disk.</a>) commands. Set to <code class="code">0</code>
1509 <br><br>
1510 </p></dd>
1512 <dd><p>Set or unset the X11 display to use when prompting for a passphrase.
1513 <br><br>
1514 </p></dd>
1516 <dd><p>Set the terminal device path to use when prompting for a passphrase.
1517 <br><br>
1518 </p></dd>
1521 <br><br>
1522 </p></dd>
1524 <dd><p>Associates the thread ID of the connection with the specified textual
1525 representation. Useful for debugging log messages. May not contain whitespace.
1526 <br><br>
1527 </p></dd>
1529 <dd><p>When not <code class="code">0</code>, the duration in tenths of a second to wait for the file
1530 mutex which has been locked by another thread to be released before returning
1532 <br><br>
1533 </p></dd>
1535 <dd><p>When set to <code class="code">1</code> then client state status messages for other clients are
1537 </p></dd>
1538 </dl>
1541 <hr>
1542 </div>
1545 <p>
1546 Next: <a href="#REALPATH" accesskey="n" rel="next">Resolving an element.</a>, Previous: <a href="#OPTION" accesskey="p" rel="prev">Setting various client parameters.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1547 </div>
1548 <h3 class="section" id="Changing-the-passphrase-for-a-key_002e"><span>8.26 Changing the passphrase for a key.<a class="copiable-link" href="#Changing-the-passphrase-for-a-key_002e"> ¶</a></span></h3>
1550 <p>Syntax:
1553 </pre></div>
1555 <p>Changes the passphrase of the secret key required to open the current
1556 data file. If the data file is symmetrically encrypted the error
1558 the <code class="code">SAVE</code> command (see <a class="pxref" href="#SAVE">Saving document changes to disk.</a>) should be used instead to prevent
1560 <br><br>
1561 Note that when the current data file has been either encrypted or signed
1562 with a key stored on a smartcard this command will return an error. In this
1565 of the key used to sign or encrypt the data file.
1566 <br><br>
1567 This command is not available to non-invoking clients
1569 </p>
1571 <hr>
1572 </div>
1575 <p>
1576 Next: <a href="#RENAME" accesskey="n" rel="next">Renaming an element.</a>, Previous: <a href="#PASSWD" accesskey="p" rel="prev">Changing the passphrase for a key.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1577 </div>
1578 <h3 class="section" id="Resolving-an-element_002e"><span>8.27 Resolving an element.<a class="copiable-link" href="#Resolving-an-element_002e"> ¶</a></span></h3>
1580 <p>Syntax:
1583 </pre></div>
1586 returns the result with a data response. See <a class="xref" href="#Target-Attribute">The <code class="code">target</code> attribute</a>, for details.
1587 <br><br>
1590 </p>
1592 <hr>
1593 </div>
1596 <p>
1597 Next: <a href="#RESET" accesskey="n" rel="next">Resetting the client state.</a>, Previous: <a href="#REALPATH" accesskey="p" rel="prev">Resolving an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1598 </div>
1599 <h3 class="section" id="Renaming-an-element_002e"><span>8.28 Renaming an element.<a class="copiable-link" href="#Renaming-an-element_002e"> ¶</a></span></h3>
1601 <p>Syntax:
1603 <pre class="example-preformatted">RENAME [--inquire] element[<TAB>child[..]] <value>
1604 </pre></div>
1606 <p>Renames the specified <var class="var">element</var> to the new <var class="var">value</var>. If an element of
1608 <br><br>
1611 </p>
1613 <hr>
1614 </div>
1617 <p>
1618 Next: <a href="#SAVE" accesskey="n" rel="next">Saving document changes to disk.</a>, Previous: <a href="#RENAME" accesskey="p" rel="prev">Renaming an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1619 </div>
1620 <h3 class="section" id="Resetting-the-client-state_002e"><span>8.29 Resetting the client state.<a class="copiable-link" href="#Resetting-the-client-state_002e"> ¶</a></span></h3>
1622 <p>Syntax:
1625 </pre></div>
1627 <p>Closes the currently opened file but keeps any previously set client options
1629 </p>
1631 <hr>
1632 </div>
1635 <p>
1636 Next: <a href="#STORE" accesskey="n" rel="next">Modifying the content of an element.</a>, Previous: <a href="#RESET" accesskey="p" rel="prev">Resetting the client state.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1637 </div>
1638 <h3 class="section" id="Saving-document-changes-to-disk_002e"><span>8.30 Saving document changes to disk.<a class="copiable-link" href="#Saving-document-changes-to-disk_002e"> ¶</a></span></h3>
1640 <p>Syntax:
1642 <pre class="example-preformatted">SAVE [--sign-keyid=[<fpr>]] [--symmetric | --keyid=<fpr>[,..] | --inquire-keyid]
1643 </pre></div>
1645 <p>Writes the in-memory <abbr class="abbr">XML</abbr> document to disk. The file written to is the
1646 file that was opened when using the <code class="code">OPEN</code> command (see <a class="pxref" href="#OPEN">Opening a data file.</a>).
1647 <br><br>
1648 If the file is a new one one of <samp class="option">--symmetric</samp>, <samp class="option">--keyid</samp> or
1649 <samp class="option">--inquire-keyid</samp> is required. When not <samp class="option">--symmetric</samp> the
1651 <br><br>
1652 You can encrypt the data file to a recipient other than the one that it
1655 public encryption key fingerprints as its argument. Use the
1656 <code class="command">LISTKEYS</code> command (see <a class="pxref" href="#LISTKEYS">Listing keys in the key ring.</a>) to show key information by
1658 file with an alternate key by specifying the fingerprint of a signing key.
1660 A passphrase to decrypt the data file
1661 will be required when one or more of the original encryption keys or signing
1662 key are not found in either of these two options’ arguments or when the data
1664 configuration parameter. The original encryption keys and signing key will be
1665 used when neither of these options are specified.
1666 <br><br>
1667 The <samp class="option">--keyid</samp> and <samp class="option">--sign-keyid</samp> options are not available
1668 to non-invoking clients
1669 (see <a class="pxref" href="#Access-Control">Access Control</a>) when the recipients or signer do not match those
1671 <br><br>
1673 conventionally encrypted. These types of data files do not use a recipient
1675 option. To remove the signing key from a symmtrically encrypted data file,
1676 leave the option value empty.
1677 <br><br>
1678 Note that you cannot change encryption schemes once a data file has been
1679 saved.
1680 </p>
1682 <hr>
1683 </div>
1686 <p>
1687 Next: <a href="#UNLOCK" accesskey="n" rel="next">Removing a data file lock.</a>, Previous: <a href="#SAVE" accesskey="p" rel="prev">Saving document changes to disk.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1688 </div>
1689 <h3 class="section" id="Modifying-the-content-of-an-element_002e"><span>8.31 Modifying the content of an element.<a class="copiable-link" href="#Modifying-the-content-of-an-element_002e"> ¶</a></span></h3>
1691 <p>Syntax:
1693 <pre class="example-preformatted">STORE [--no-inherit-acl] element[<TAB>child[..]]<TAB>[content]
1694 </pre></div>
1697 <br><br>
1699 element. If only a single element is specified then a new root element is
1701 set to the final <kbd class="key">TAB</kbd> delimited element. If no <var class="var">content</var> is
1703 element will be removed; or will be empty if creating a new element.
1704 <br><br>
1707 case, the current user is made the owner of the newly created element(s).
1708 <br><br>
1709 The only restriction of an element name is that it not contain whitespace
1711 elements. It is recommended that the content of an element be base64 encoded
1712 when it contains control or <kbd class="key">TAB</kbd> characters to prevent <abbr class="abbr">XML</abbr>
1714 </p>
1716 <hr>
1717 </div>
1720 <p>
1721 Next: <a href="#XPATH" accesskey="n" rel="next">Modifying more than one element.</a>, Previous: <a href="#STORE" accesskey="p" rel="prev">Modifying the content of an element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1722 </div>
1723 <h3 class="section" id="Removing-a-data-file-lock_002e"><span>8.32 Removing a data file lock.<a class="copiable-link" href="#Removing-a-data-file-lock_002e"> ¶</a></span></h3>
1725 <p>Syntax:
1728 </pre></div>
1731 a commands’ <samp class="option">--lock</samp> option (see <a class="pxref" href="#LOCK">Locking the current data file.</a>, see <a class="pxref" href="#OPEN">Opening a data file.</a>,
1733 </p>
1735 <hr>
1736 </div>
1739 <p>
1740 Next: <a href="#XPATHATTR" accesskey="n" rel="next">Modifying more than one element’s attributes.</a>, Previous: <a href="#UNLOCK" accesskey="p" rel="prev">Removing a data file lock.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1741 </div>
1742 <h3 class="section" id="Modifying-more-than-one-element_002e"><span>8.33 Modifying more than one element.<a class="copiable-link" href="#Modifying-more-than-one-element_002e"> ¶</a></span></h3>
1744 <p>Syntax:
1747 </pre></div>
1749 <p>Evaluates an XPath <var class="var">expression</var>. If no <var class="var">value</var> argument is
1750 specified it is assumed the expression is a request to return a result.
1752 updated. If there is no <var class="var">value</var> after the <kbd class="key">TAB</kbd> character, the value
1753 is assumed to be empty and the document is updated. For example:
1754 </p><br>
1757 </pre></div>
1758 <br>
1760 while leaving off the trailing <kbd class="key">TAB</kbd> would return all <var class="var">password</var>
1762 <br><br>
1765 <br><br>
1766 See <a class="url" href="https://www.w3schools.com/xml/xpath_intro.asp">https://www.w3schools.com/xml/xpath_intro.asp</a> for <abbr class="abbr">XPATH</abbr>
1767 expression syntax.
1768 </p>
1770 <hr>
1771 </div>
1774 <p>
1775 Previous: <a href="#XPATH" accesskey="p" rel="prev">Modifying more than one element.</a>, Up: <a href="#Commands" accesskey="u" rel="up">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1776 </div>
1777 <h3 class="section" id="Modifying-more-than-one-element_0027s-attributes_002e"><span>8.34 Modifying more than one element’s attributes.<a class="copiable-link" href="#Modifying-more-than-one-element_0027s-attributes_002e"> ¶</a></span></h3>
1779 <p>Syntax:
1781 <pre class="example-preformatted">XPATHATTR [--inquire] SET|DELETE <name> <expression>[<TAB>[<value>]]
1782 </pre></div>
1784 <p>Like the <code class="code">XPATH</code> command (see <a class="pxref" href="#XPATH">Modifying more than one element.</a>) but operates on element
1787 the attribute value will be empty. For example:
1788 </p><br>
1790 <pre class="example-preformatted">XPATHATTR SET password //element[@_name='password']<kbd class="key">TAB</kbd>
1791 </pre></div>
1792 <br>
1793 <p>would create a <var class="var">password</var> attribute for each <var class="var">password</var> element
1794 found in the document. The attribute value will be empty but still exist.
1795 <br><br>
1798 <br><br>
1799 See <a class="url" href="https://www.w3schools.com/xml/xpath_intro.asp">https://www.w3schools.com/xml/xpath_intro.asp</a> for <abbr class="abbr">XPATH</abbr>
1800 expression syntax.
1801 </p>
1804 <hr>
1805 </div>
1806 </div>
1809 <p>
1810 Next: <a href="#Status-Messages" accesskey="n" rel="next">Status messages and their meanings</a>, Previous: <a href="#Commands" accesskey="p" rel="prev">Protocol commands and their syntax</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1811 </div>
1812 <h2 class="chapter" id="Running-multiple-commands-in-sequence"><span>9 Running multiple commands in sequence<a class="copiable-link" href="#Running-multiple-commands-in-sequence"> ¶</a></span></h2>
1813 <p>Multiple commands may be run in sequence by using the <code class="code">BULK</code> command
1814 (see <a class="pxref" href="#BULK">Run a series of commands in sequence.</a>). Using this feature may speed up remote connections since less
1815 socket IO is needed. The <code class="code">BULK</code> command uses an <em class="emph">INQUIRE</em> to obtain
1816 an canonical s-expression of commands to be run. The s-expression syntax is as
1817 follows:
1818 </p>
1820 <pre class="example-preformatted">(2:id<I>:<id> <P>:<prot><D>:[<data>] [2:rc<R>:<code>[|<code>...2:id...| 2:id...])
1821 </pre></div>
1823 <p>Each token is prefixed with an unsigned integer that specifies the length of
1824 the token, followed by a colon ’<code class="code">:</code>’, followed by the token itself. Pwmd
1826 allowed between token pairs. For example, the following is valid:
1827 </p>
1829 <pre class="example-preformatted">( 2:id 7:FirstID 4:LIST0: 2:rc 1:0 (2:id6:Second 7:GETINFO7:version))
1830 </pre></div>
1832 <p>The <code class="code">id</code> token begins a new command and requires an <var class="var"><id></var> token
1833 of length <var class="var"><I></var> to uniquely identify this command. The next token pair is
1834 the protocol command name, without any command arguments, of length <var class="var"><P></var>
1835 to run followed by a colon ’<code class="code">:</code>’, followed by the command <var class="var"><prot></var>
1836 itself, followed by the length <var class="var"><D></var> of both command arguments and data,
1837 followed by a colon ’<code class="code">:</code>’ and finally the <var class="var"><data></var> itself. If no
1838 arguments or data are needed for the command, set the length of the data
1839 <var class="var"><D></var> to <code class="code">0</code> and append the required colon ’<code class="code">:</code>’.
1840 </p>
1841 <p>A new command enclosed in parentheses may be run when the previous command
1842 returns an error code that matches the <var class="var"><code></var> token of length <var class="var"><R></var>
1843 by appending <var class="var">rc</var> tokens to the end of the previous commands <var class="var"><data></var>
1844 token. You may also test another return code for the previous command by
1846 previous return code command.
1847 </p>
1848 <p>Multiple <code class="code">rc</code> <var class="var">code</var>’s may be specified for a single command by
1851 </p>
1852 <p>If another command is to be run after the previous and does not specify an
1854 next command is run. There is no limit on the number of commands or
1855 sub-commands except for system memory.
1856 </p>
1857 <p>After inquiring the commands to be run, <code class="code">BULK</code> will run each command with
1858 <var class="var"><data></var> as its argument and store the result code and data of the command
1860 </p>
1862 <pre class="example-preformatted">(11:bulk-result2:id<I>:<id>2:rc<R>:<code><D>:[<data>][2:id...])
1863 </pre></div>
1866 <var class="var"><id></var> token of length <var class="var"><I></var> is the same that was associated with the
1867 command from the <em class="emph">INQUIRE</em>’d syntax and is prefixed with <code class="code">2:id</code>. The
1868 return code of the command is prefixed with <code class="code">2:rc</code> followed by the length
1869 <var class="var"><R></var> of the unsigned integer <var class="var"><code></var> then the return <var class="var"><code></var>
1871 length <var class="var"><D></var> and immediately following the return <var class="var"><code></var>. Otherwise,
1872 <var class="var"><D></var> will be <code class="code">0</code> and followed by a colon ’<code class="code">:</code>’.
1873 </p>
1875 <hr>
1876 </div>
1879 <p>
1880 Next: <a href="#Target-Attribute" accesskey="n" rel="next">The <code class="code">target</code> attribute</a>, Previous: <a href="#Bulk-Commands" accesskey="p" rel="prev">Running multiple commands in sequence</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1881 </div>
1882 <h2 class="chapter" id="Status-messages-and-their-meanings"><span>10 Status messages and their meanings<a class="copiable-link" href="#Status-messages-and-their-meanings"> ¶</a></span></h2>
1883 <p>Some commands send status messages to inform the client about certain
1884 operations or as a progress indicator. Status messages begin with a
1886 require it. What status messages are sent, when, and how often may depend on
1887 configuration settings (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>).
1888 </p>
1890 <thead><tr><th width="20%">Message</th><th width="25%">Parameters</th><th width="55%">Description</th></tr></thead>
1892 <a class="index-entry-id" id="index-CACHE"></a></td><td width="25%"><code class="code"><integer></code></td><td width="55%">The number of cached documents. Sent to each client after connecting
1893 (see <a class="pxref" href="#GETINFO">Obtaining server and client information.</a>) and to every client after a cache modification.</td></tr>
1895 <a class="index-entry-id" id="index-CLIENTS"></a></td><td width="25%"><code class="code"><integer></code></td><td width="55%">The number of connected clients (see <a class="pxref" href="#GETINFO">Obtaining server and client information.</a>). Sent to each client
1896 when another client either connects or disconnects.</td></tr>
1898 <a class="index-entry-id" id="index-DECRYPT"></a></td><td width="25%"></td><td width="55%">Sent to the current client during a decrypt operation. How often this
1900 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) setting.</td></tr>
1902 <a class="index-entry-id" id="index-ENCRYPT"></a></td><td width="25%"></td><td width="55%">Sent to the current client during an encrypt operation. How often this
1904 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) setting.</td></tr>
1906 <a class="index-entry-id" id="index-GENKEY"></a></td><td width="25%"><code class="code">[<sigkey_fpr> <pubkey_fpr>]</code></td><td width="55%">Sent to the current client during key generation. How often this
1908 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) setting. The <var class="var">sigkey_fpr</var> and <var class="var">pubkey_fpr</var>
1909 parameters are added when key generation has completed.</td></tr>
1911 <a class="index-entry-id" id="index-INQUIRE_005fMAXLEN"></a></td><td width="25%"><code class="code"><bytes></code></td><td width="55%">Sent to the current client from <code class="command">gpg-agent</code> when inquiring data.
1912 This specifies the maximum number of bytes allowed for the client to send and
1913 should not be exceeded.</td></tr>
1915 <a class="index-entry-id" id="index-KEEPALIVE"></a></td><td width="25%"></td><td width="55%">Sent to each idle client every <var class="var">keepalive_interval</var>
1916 (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>) seconds.</td></tr>
1918 <a class="index-entry-id" id="index-LOCKED"></a></td><td width="25%"></td><td width="55%">Sent to the current client when another client is holding the lock for
1919 the mutex associated with a data file. How often this status message is sent
1920 is determined by the <code class="code">keepalive_interval</code> (see <a class="pxref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>)
1921 setting.</td></tr>
1923 <a class="index-entry-id" id="index-NEWFILE"></a></td><td width="25%"></td><td width="55%">Sent to the current client when the opened (see <a class="pxref" href="#OPEN">Opening a data file.</a>) file does not
1924 exist on the file-system.</td></tr>
1926 <a class="index-entry-id" id="index-MODIFIED"></a></td><td width="25%"><code class="code"><client_id></code></td><td width="55%">Sent to each client with the same opened data file as <var class="var">client_id</var> to
1927 inform them of modifications that were written to disk using the
1930 <a class="index-entry-id" id="index-XFER"></a></td><td width="25%"><code class="code"><sent> <total></code></td><td width="55%">Sent to the current client when transferring data. It has two space
1931 delimited arguments. The first being the current amount of bytes transferred
1932 and the other being the total bytes to be transferred. Note that since version
1933 <code class="code">3.1.1</code> of <code class="command">pwmd</code> this status message is sent only once and
1934 before the transfer begins with the <var class="var">total</var> argument set to the size of the
1935 data and the <var class="var">sent</var> argument set to <code class="code">0</code> leaving it to the client to
1936 determine the progress of the transfer as the data is received.</td></tr>
1938 <a class="index-entry-id" id="index-STATE"></a></td><td width="25%"><code class="code"><client_id> <state></code></td><td width="55%">Sent to each client to indicate that <var class="var">client_id</var> has changed to
1939 <var class="var">state</var> (see <a class="pxref" href="#GETINFO">Obtaining server and client information.</a> for client states). For a client to receive
1943 <a class="index-entry-id" id="index-EXPIRE"></a></td><td width="25%"><code class="code"><epoch_seconds> <epoch_future>|0</code></td><td width="55%">Sent to the current client when <code class="code">GET</code> (see <a class="pxref" href="#GET">Getting the content of an element.</a>) encounters an
1944 <code class="code">_expire</code> (see <a class="pxref" href="#Other-Attributes">Other special attributes</a>) attribute that is in the past or when
1945 <code class="code">STORE</code> (see <a class="pxref" href="#STORE">Modifying the content of an element.</a>) updates the <code class="code">_expire</code> attribute from the
1946 <code class="code">_age</code> attribute value. The second field will be <code class="code">0</code> when <code class="code">GET</code>
1947 sends this status message. Otherwise the second field is the time the next
1948 expiry will be.</td></tr>
1950 <a class="index-entry-id" id="index-PASSPHRASE_005fHINT"></a></td><td width="25%"><keyid> <userid></td><td width="55%">Forwarded from <code class="code">GpgME</code>. Contains information that is useful in a
1951 <code class="command">pinentry</code>. Only sent when pinentry is disabled (see <a class="pxref" href="#OPTION">Setting various client parameters.</a>).</td></tr>
1953 <a class="index-entry-id" id="index-PASSPHRASE_005fINFO"></a></td><td width="25%"><flags> …</td><td width="55%">Forwarded from <code class="code">GpgME</code>. Contains information that is useful in a
1954 <code class="command">pinentry</code>. Only sent when pinentry is disabled (see <a class="pxref" href="#OPTION">Setting various client parameters.</a>).</td></tr>
1956 <a class="index-entry-id" id="index-REHANDSHAKE"></a></td><td width="25%"></td><td width="55%">Sent to each <abbr class="acronym">TLS</abbr> client just before performing a cipher renegotiation
1957 after a SIGHUP signal was received.</td></tr>
1959 <a class="index-entry-id" id="index-BULK"></a></td><td width="25%"><code class="code">BEGIN|END <command id></code></td><td width="55%">Sent to the current client before and after the <code class="code">BULK</code> command
1960 (see <a class="pxref" href="#BULK">Run a series of commands in sequence.</a>) runs each command. The <var class="var"><command id></var> is the same that was
1961 associated with the command in the s-expression syntax.</td></tr>
1962 </tbody>
1963 </table>
1965 <hr>
1966 </div>
1969 <p>
1970 Next: <a href="#Other-Attributes" accesskey="n" rel="next">Other special attributes</a>, Previous: <a href="#Status-Messages" accesskey="p" rel="prev">Status messages and their meanings</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
1971 </div>
1972 <h2 class="chapter" id="The-target-attribute"><span>11 The <code class="code">target</code> attribute<a class="copiable-link" href="#The-target-attribute"> ¶</a></span></h2>
1974 <p>A <em class="emph">case sensitive</em> attribute named <code class="code">_target</code> is treated specially
1975 when found in each element of an element path. This attribute, like other
1977 (see <a class="pxref" href="#ATTR">Modifying element attributes.</a>). The value of this attribute is an existing element path
1978 somewhere in the document. If you are familiar with <abbr class="acronym">XML</abbr> entities or
1979 maybe the HTML <code class="code">id</code> or <code class="code">_target</code> attributes or a symbolic link
1980 in a file-system, you may find this attribute behaves similar to any of those.
1981 </p>
1983 </p>
1985 <pre class="example-preformatted">ATTR SET _target element[<code class="code">TAB</code>child[..]] element[<code class="code">TAB</code>child[..]]
1986 </pre></div>
1988 <p>Note the single space between the two element paths. The first element path is
1989 where the <code class="code">_target</code> attribute will be created. If the element path does
1991 (see <a class="pxref" href="#ATTR">Modifying element attributes.</a>) command will create elements. The attribute is created in the
1992 final element of the element path.
1993 </p>
1994 <p>The second element path is the destination of where you want the first element
1995 path to resolve to. When an element path is passed as an argument to a
1996 protocol command <code class="command">pwmd</code> looks for a <code class="code">_target</code> attribute when
1998 continues resolving any remaining elements a commands element path.
1999 </p>
2000 <p>When an element of a element path is removed that a <code class="code">_target</code> attribute
2001 resolves to then an error will occur when trying to access that element. You
2002 may need to either update the <code class="code">_target</code> attribute value with a new element
2003 path or remove the attribute entirely.
2004 </p>
2005 <p>Clients should be careful of creating <code class="code">_target</code> loops, or targets that
2006 resolve to themselves. See the <var class="var">recursion_depth</var> in <a class="ref" href="#Configuration"><code class="command">pwmd</code> configuration file options</a>
2007 for details.
2008 </p>
2009 <p>The <code class="code">REALPATH</code> command (see <a class="pxref" href="#REALPATH">Resolving an element.</a>) can be used to show the element
2011 </p>
2013 be removed.</em>
2014 </p>
2016 <hr>
2017 </div>
2020 <p>
2021 Next: <a href="#Key-Expiration" accesskey="n" rel="next">Key Expiration</a>, Previous: <a href="#Target-Attribute" accesskey="p" rel="prev">The <code class="code">target</code> attribute</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
2022 </div>
2023 <h2 class="chapter" id="Other-special-attributes"><span>12 Other special attributes<a class="copiable-link" href="#Other-special-attributes"> ¶</a></span></h2>
2025 <p>In addition to the <code class="code">_target</code> attribute (see <a class="pxref" href="#Target-Attribute">The <code class="code">target</code> attribute</a>), there
2026 are a few other attributes that are specially handled by <code class="command">pwmd</code>. The
2027 first is the <code class="code">_ctime</code> attribute which is set to the current time when an
2028 element is created. Next is the <code class="code">_mtime</code> attribute which is created when
2029 an element is created and also updated when an element is modified. Neither of
2031 controls access to the element, albeit modifying or accessing element content,
2032 or descending into child elements. See <a class="xref" href="#Access-Control">Access Control</a> for details. The
2034 </p>
2035 <p>The above mentioned attributes are considered reserved attribute names.
2036 Reserved attributes are treated specially when a <code class="code">_target</code> attribute is
2038 attribute values for the current element and not the attribute values for the
2040 resolved <code class="code">_target</code> are appended to the <code class="code">ATTR LIST</code> command output.
2041 Other <code class="code">ATTR</code> commands (see <a class="pxref" href="#ATTR">Modifying element attributes.</a>) behave as usual. You can, for
2043 contains a <code class="code">_target</code> attribute. The resolved target elements’ attribute
2045 attribute.
2046 </p>
2047 <p>Another specially handled attribute is the <code class="code">_expire</code> attribute. This
2048 attribute value, like the <code class="code">_ctime</code> and <code class="code">_mtime</code> attributes, is a
2049 timestamp. But this timestamp is usually in the future and for use with the
2050 <code class="code">GET</code> (see <a class="pxref" href="#GET">Getting the content of an element.</a>) and <code class="code">STORE</code> (see <a class="pxref" href="#STORE">Modifying the content of an element.</a>) commands. When the
2051 <code class="code">GET</code> command is issued, it checks for an <code class="code">_expire</code> attribute an
2052 compares its’ value with the current time. If the <code class="code">_expire</code> timestamp is
2053 in the past then a status message is sent (see <a class="pxref" href="#Status-Messages">Status messages and their meanings</a>) to inform
2054 the client that the element content should be updated. When the content for
2056 <code class="code">STORE</code> command, the value of the <code class="code">_age</code> attribute is added to the
2058 <code class="code">_age</code> attribute is found, no modification is done of the <code class="code">_expire</code>
2059 attribute.
2060 </p>
2062 <hr>
2063 </div>
2066 <p>
2067 Next: <a href="#Signals" accesskey="n" rel="next">Recognized signals</a>, Previous: <a href="#Other-Attributes" accesskey="p" rel="prev">Other special attributes</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
2068 </div>
2069 <h2 class="chapter" id="Key-Expiration-1"><span>13 Key Expiration<a class="copiable-link" href="#Key-Expiration-1"> ¶</a></span></h2>
2071 <p>When a key used for signing a data file has expired there is no indication
2073 cannot sign the data file with an expired key. The client will need to either
2074 use a different key for signing by either specifying an existing non-expired
2075 key, generate a new key, or change the expire time of the existing key with
2077 </p>
2078 <p>To change the expiration of the currently used signing key with <code class="command">gpg</code>,
2079 use the <code class="code">KEYINFO</code> command (see <a class="pxref" href="#KEYINFO">Showing keys used for the current data file.</a>) to obtain the fingerprint of
2080 the signing key of the current data file, then change the expire time with
2082 </p>
2085 </pre></div>
2089 </p>
2091 <hr>
2092 </div>
2095 <p>
2096 Next: <a href="#Index" accesskey="n" rel="next">Index</a>, Previous: <a href="#Key-Expiration" accesskey="p" rel="prev">Key Expiration</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
2097 </div>
2098 <h2 class="chapter" id="Recognized-signals"><span>14 Recognized signals<a class="copiable-link" href="#Recognized-signals"> ¶</a></span></h2>
2100 <p>Sending the <em class="emph">SIGHUP</em> signal to a <code class="command">pwmd</code> process will reload the
2102 cache.
2103 </p>
2106 <hr>
2107 </div>
2110 <p>
2111 Previous: <a href="#Signals" accesskey="p" rel="prev">Recognized signals</a> [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="#Index" title="Index" rel="index">Index</a>]</p>
2112 </div>
2113 <h2 class="unnumbered" id="Index-1"><span>Index<a class="copiable-link" href="#Index-1"> ¶</a></span></h2>
2115 <table class="cp-letters-header-printindex"><tr><th>Jump to: </th><td><a class="summary-letter-printindex" href="#Index_cp_letter-A"><b>A</b></a>
2116
2118
2120
2122
2124
2126
2128
2130
2132
2134
2136
2138
2140
2142
2144
2146
2148
2150
2152
2153 </td></tr></table>
2155 <tr><td></td><th class="entries-header-printindex">Index Entry</th><th class="sections-header-printindex">Section</th></tr>
2158 <tr><td></td><td class="printindex-index-entry"><a href="#index-allowed">allowed</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2159 <tr><td></td><td class="printindex-index-entry"><a href="#index-allowed_005ffile">allowed_file</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2160 <tr><td></td><td class="printindex-index-entry"><a href="#index-always_005ftrust">always_trust</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2161 <tr><td></td><td class="printindex-index-entry"><a href="#index-Arguments">Arguments</a></td><td class="printindex-index-section"><a href="#Invoking">Invoking</a></td></tr>
2162 <tr><td></td><td class="printindex-index-entry"><a href="#index-ATTR-command">ATTR command</a></td><td class="printindex-index-section"><a href="#ATTR">ATTR</a></td></tr>
2165 <tr><td></td><td class="printindex-index-entry"><a href="#index-backlog">backlog</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2166 <tr><td></td><td class="printindex-index-entry"><a href="#index-backup">backup</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2167 <tr><td></td><td class="printindex-index-entry"><a href="#index-BULK">BULK</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2168 <tr><td></td><td class="printindex-index-entry"><a href="#index-BULK-command">BULK command</a></td><td class="printindex-index-section"><a href="#BULK">BULK</a></td></tr>
2171 <tr><td></td><td class="printindex-index-entry"><a href="#index-CACHE">CACHE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2172 <tr><td></td><td class="printindex-index-entry"><a href="#index-cache_005fpush">cache_push</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2173 <tr><td></td><td class="printindex-index-entry"><a href="#index-cache_005ftimeout">cache_timeout</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2174 <tr><td></td><td class="printindex-index-entry"><a href="#index-CACHETIMEOUT-command">CACHETIMEOUT command</a></td><td class="printindex-index-section"><a href="#CACHETIMEOUT">CACHETIMEOUT</a></td></tr>
2175 <tr><td></td><td class="printindex-index-entry"><a href="#index-CLEARCACHE-command">CLEARCACHE command</a></td><td class="printindex-index-section"><a href="#CLEARCACHE">CLEARCACHE</a></td></tr>
2176 <tr><td></td><td class="printindex-index-entry"><a href="#index-CLIENTS">CLIENTS</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2177 <tr><td></td><td class="printindex-index-entry"><a href="#index-COPY-command">COPY command</a></td><td class="printindex-index-section"><a href="#COPY">COPY</a></td></tr>
2180 <tr><td></td><td class="printindex-index-entry"><a href="#index-Data-file-configuration-options">Data file configuration options</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2181 <tr><td></td><td class="printindex-index-entry"><a href="#index-DECRYPT">DECRYPT</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2182 <tr><td></td><td class="printindex-index-entry"><a href="#index-DELETE-command">DELETE command</a></td><td class="printindex-index-section"><a href="#DELETE">DELETE</a></td></tr>
2183 <tr><td></td><td class="printindex-index-entry"><a href="#index-DELETEKEY-command">DELETEKEY command</a></td><td class="printindex-index-section"><a href="#DELETEKEY">DELETEKEY</a></td></tr>
2184 <tr><td></td><td class="printindex-index-entry"><a href="#index-disable_005flist_005fand_005fdump">disable_list_and_dump</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2185 <tr><td></td><td class="printindex-index-entry"><a href="#index-disable_005fmlockall">disable_mlockall</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2186 <tr><td></td><td class="printindex-index-entry"><a href="#index-DUMP-command">DUMP command</a></td><td class="printindex-index-section"><a href="#DUMP">DUMP</a></td></tr>
2189 <tr><td></td><td class="printindex-index-entry"><a href="#index-enable_005flogging">enable_logging</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2190 <tr><td></td><td class="printindex-index-entry"><a href="#index-enable_005ftcp">enable_tcp</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2191 <tr><td></td><td class="printindex-index-entry"><a href="#index-ENCRYPT">ENCRYPT</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2192 <tr><td></td><td class="printindex-index-entry"><a href="#index-encrypt_005fto">encrypt_to</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2193 <tr><td></td><td class="printindex-index-entry"><a href="#index-EXPIRE">EXPIRE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2196 <tr><td></td><td class="printindex-index-entry"><a href="#index-GENKEY">GENKEY</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2197 <tr><td></td><td class="printindex-index-entry"><a href="#index-GENKEY-command">GENKEY command</a></td><td class="printindex-index-section"><a href="#GENKEY">GENKEY</a></td></tr>
2198 <tr><td></td><td class="printindex-index-entry"><a href="#index-GET-command">GET command</a></td><td class="printindex-index-section"><a href="#GET">GET</a></td></tr>
2199 <tr><td></td><td class="printindex-index-entry"><a href="#index-GETCONFIG-command">GETCONFIG command</a></td><td class="printindex-index-section"><a href="#GETCONFIG">GETCONFIG</a></td></tr>
2200 <tr><td></td><td class="printindex-index-entry"><a href="#index-GETINFO-command">GETINFO command</a></td><td class="printindex-index-section"><a href="#GETINFO">GETINFO</a></td></tr>
2201 <tr><td></td><td class="printindex-index-entry"><a href="#index-Getting-help">Getting help</a></td><td class="printindex-index-section"><a href="#Invoking">Invoking</a></td></tr>
2202 <tr><td></td><td class="printindex-index-entry"><a href="#index-Global-configuration-options">Global configuration options</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2203 <tr><td></td><td class="printindex-index-entry"><a href="#index-gpg_005fhomedir">gpg_homedir</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2206 <tr><td></td><td class="printindex-index-entry"><a href="#index-HELP-command">HELP command</a></td><td class="printindex-index-section"><a href="#HELP">HELP</a></td></tr>
2209 <tr><td></td><td class="printindex-index-entry"><a href="#index-IMPORT-command">IMPORT command</a></td><td class="printindex-index-section"><a href="#IMPORT">IMPORT</a></td></tr>
2210 <tr><td></td><td class="printindex-index-entry"><a href="#index-INQUIRE_005fMAXLEN">INQUIRE_MAXLEN</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2211 <tr><td></td><td class="printindex-index-entry"><a href="#index-invoking_005ffile">invoking_file</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2212 <tr><td></td><td class="printindex-index-entry"><a href="#index-invoking_005fuser">invoking_user</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2213 <tr><td></td><td class="printindex-index-entry"><a href="#index-ISCACHED-command">ISCACHED command</a></td><td class="printindex-index-section"><a href="#ISCACHED">ISCACHED</a></td></tr>
2216 <tr><td></td><td class="printindex-index-entry"><a href="#index-KEEPALIVE">KEEPALIVE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2217 <tr><td></td><td class="printindex-index-entry"><a href="#index-keepalive_005finterval">keepalive_interval</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2218 <tr><td></td><td class="printindex-index-entry"><a href="#index-key-expiration">key expiration</a></td><td class="printindex-index-section"><a href="#Key-Expiration">Key Expiration</a></td></tr>
2219 <tr><td></td><td class="printindex-index-entry"><a href="#index-KEYINFO-command">KEYINFO command</a></td><td class="printindex-index-section"><a href="#KEYINFO">KEYINFO</a></td></tr>
2220 <tr><td></td><td class="printindex-index-entry"><a href="#index-KILL-command">KILL command</a></td><td class="printindex-index-section"><a href="#KILL">KILL</a></td></tr>
2221 <tr><td></td><td class="printindex-index-entry"><a href="#index-kill_005fscd">kill_scd</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2224 <tr><td></td><td class="printindex-index-entry"><a href="#index-LIST-command">LIST command</a></td><td class="printindex-index-section"><a href="#LIST">LIST</a></td></tr>
2225 <tr><td></td><td class="printindex-index-entry"><a href="#index-LISTKEYS-command">LISTKEYS command</a></td><td class="printindex-index-section"><a href="#LISTKEYS">LISTKEYS</a></td></tr>
2226 <tr><td></td><td class="printindex-index-entry"><a href="#index-LOCK-command">LOCK command</a></td><td class="printindex-index-section"><a href="#LOCK">LOCK</a></td></tr>
2227 <tr><td></td><td class="printindex-index-entry"><a href="#index-lock_005ftimeout">lock_timeout</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2228 <tr><td></td><td class="printindex-index-entry"><a href="#index-LOCKED">LOCKED</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2229 <tr><td></td><td class="printindex-index-entry"><a href="#index-log_005fkeepopen">log_keepopen</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2230 <tr><td></td><td class="printindex-index-entry"><a href="#index-log_005flevel">log_level</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2231 <tr><td></td><td class="printindex-index-entry"><a href="#index-log_005fpath">log_path</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2232 <tr><td></td><td class="printindex-index-entry"><a href="#index-LS-command">LS command</a></td><td class="printindex-index-section"><a href="#LS">LS</a></td></tr>
2235 <tr><td></td><td class="printindex-index-entry"><a href="#index-MODIFIED">MODIFIED</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2236 <tr><td></td><td class="printindex-index-entry"><a href="#index-MOVE-command">MOVE command</a></td><td class="printindex-index-section"><a href="#MOVE">MOVE</a></td></tr>
2239 <tr><td></td><td class="printindex-index-entry"><a href="#index-NEWFILE">NEWFILE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2240 <tr><td></td><td class="printindex-index-entry"><a href="#index-NOP-command">NOP command</a></td><td class="printindex-index-section"><a href="#NOP">NOP</a></td></tr>
2243 <tr><td></td><td class="printindex-index-entry"><a href="#index-OPEN-command">OPEN command</a></td><td class="printindex-index-section"><a href="#OPEN">OPEN</a></td></tr>
2244 <tr><td></td><td class="printindex-index-entry"><a href="#index-OPTION-command">OPTION command</a></td><td class="printindex-index-section"><a href="#OPTION">OPTION</a></td></tr>
2245 <tr><td></td><td class="printindex-index-entry"><a href="#index-Options">Options</a></td><td class="printindex-index-section"><a href="#Invoking">Invoking</a></td></tr>
2248 <tr><td></td><td class="printindex-index-entry"><a href="#index-passphrase_005ffile">passphrase_file</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2249 <tr><td></td><td class="printindex-index-entry"><a href="#index-PASSPHRASE_005fHINT">PASSPHRASE_HINT</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2250 <tr><td></td><td class="printindex-index-entry"><a href="#index-PASSPHRASE_005fINFO">PASSPHRASE_INFO</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2251 <tr><td></td><td class="printindex-index-entry"><a href="#index-PASSWD-command">PASSWD command</a></td><td class="printindex-index-section"><a href="#PASSWD">PASSWD</a></td></tr>
2252 <tr><td></td><td class="printindex-index-entry"><a href="#index-priority">priority</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2255 <tr><td></td><td class="printindex-index-entry"><a href="#index-REALPATH-command">REALPATH command</a></td><td class="printindex-index-section"><a href="#REALPATH">REALPATH</a></td></tr>
2256 <tr><td></td><td class="printindex-index-entry"><a href="#index-recursion_005fdepth">recursion_depth</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2257 <tr><td></td><td class="printindex-index-entry"><a href="#index-REHANDSHAKE">REHANDSHAKE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2258 <tr><td></td><td class="printindex-index-entry"><a href="#index-Reloading-the-configuration-file">Reloading the configuration file</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2259 <tr><td></td><td class="printindex-index-entry"><a href="#index-RENAME-command">RENAME command</a></td><td class="printindex-index-section"><a href="#RENAME">RENAME</a></td></tr>
2260 <tr><td></td><td class="printindex-index-entry"><a href="#index-require_005fsave_005fkey">require_save_key</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2261 <tr><td></td><td class="printindex-index-entry"><a href="#index-RESET-command">RESET command</a></td><td class="printindex-index-section"><a href="#RESET">RESET</a></td></tr>
2262 <tr><td></td><td class="printindex-index-entry"><a href="#index-Running-pwmd">Running <code class="command">pwmd</code></a></td><td class="printindex-index-section"><a href="#Invoking">Invoking</a></td></tr>
2265 <tr><td></td><td class="printindex-index-entry"><a href="#index-SAVE-command">SAVE command</a></td><td class="printindex-index-section"><a href="#SAVE">SAVE</a></td></tr>
2266 <tr><td></td><td class="printindex-index-entry"><a href="#index-socket_005fpath">socket_path</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2267 <tr><td></td><td class="printindex-index-entry"><a href="#index-socket_005fperms">socket_perms</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2268 <tr><td></td><td class="printindex-index-entry"><a href="#index-special-attributes">special attributes</a></td><td class="printindex-index-section"><a href="#Other-Attributes">Other Attributes</a></td></tr>
2269 <tr><td></td><td class="printindex-index-entry"><a href="#index-STATE">STATE</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2270 <tr><td></td><td class="printindex-index-entry"><a href="#index-STORE-command">STORE command</a></td><td class="printindex-index-section"><a href="#STORE">STORE</a></td></tr>
2271 <tr><td></td><td class="printindex-index-entry"><a href="#index-strict_005fkill">strict_kill</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2272 <tr><td></td><td class="printindex-index-entry"><a href="#index-strict_005fopen">strict_open</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2273 <tr><td></td><td class="printindex-index-entry"><a href="#index-syslog">syslog</a></td><td class="printindex-index-section"><a href="#Configuration">Configuration</a></td></tr>
2276 <tr><td></td><td class="printindex-index-entry"><a href="#index-target-attribute">target attribute</a></td><td class="printindex-index-section"><a href="#Target-Attribute">Target Attribute</a></td></tr>
2277 <tr><td></td><td class="printindex-index-entry"><a href="#index-tcp_005fbind">tcp_bind</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2278 <tr><td></td><td class="printindex-index-entry"><a href="#index-tcp_005finterface">tcp_interface</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2279 <tr><td></td><td class="printindex-index-entry"><a href="#index-tcp_005fport">tcp_port</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2280 <tr><td></td><td class="printindex-index-entry"><a href="#index-tcp_005frequire_005fkey">tcp_require_key</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2281 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fca_005ffile">tls_ca_file</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2282 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fcipher_005fsuite">tls_cipher_suite</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2283 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fcrl_005ffile">tls_crl_file</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2284 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fdh_005fparams_005ffile">tls_dh_params_file</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2285 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fserver_005fcert_005ffile">tls_server_cert_file</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2286 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fserver_005fkey_005ffile">tls_server_key_file</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2287 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005ftimeout">tls_timeout</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2288 <tr><td></td><td class="printindex-index-entry"><a href="#index-tls_005fuse_005fcrl">tls_use_crl</a></td><td class="printindex-index-section"><a href="#TLS">TLS</a></td></tr>
2291 <tr><td></td><td class="printindex-index-entry"><a href="#index-UNLOCK-command">UNLOCK command</a></td><td class="printindex-index-section"><a href="#UNLOCK">UNLOCK</a></td></tr>
2294 <tr><td></td><td class="printindex-index-entry"><a href="#index-XFER">XFER</a></td><td class="printindex-index-section"><a href="#Status-Messages">Status Messages</a></td></tr>
2295 <tr><td></td><td class="printindex-index-entry"><a href="#index-XPATH-command">XPATH command</a></td><td class="printindex-index-section"><a href="#XPATH">XPATH</a></td></tr>
2296 <tr><td></td><td class="printindex-index-entry"><a href="#index-XPATHATTR-command">XPATHATTR command</a></td><td class="printindex-index-section"><a href="#XPATHATTR">XPATHATTR</a></td></tr>
2298 </table>
2299 <table class="cp-letters-footer-printindex"><tr><th>Jump to: </th><td><a class="summary-letter-printindex" href="#Index_cp_letter-A"><b>A</b></a>
2300
2302
2304
2306
2308
2310
2312
2314
2316
2318
2320
2322
2324
2326
2328
2330
2332
2334
2336
2337 </td></tr></table>
2338 </div>
2340 </div>
2341 </div>
2345 </body>
2346 </html>