doc/pwmd.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
   2 <html>
   3 <!-- Created by GNU Texinfo 5.1, http://www.gnu.org/software/texinfo/ -->
   4 <head>
   5 <title>PWMD Manual</title>
   6
   7 <meta name="description" content="PWMD Manual">
   8 <meta name="keywords" content="PWMD Manual">
   9 <meta name="resource-type" content="document">
  10 <meta name="distribution" content="global">
  11 <meta name="Generator" content="makeinfo">
  12 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  13 <link href="#Top" rel="start" title="Top">
  14 <link href="#SEC_Contents" rel="contents" title="Table of Contents">
  15 <link href="dir.html#Top" rel="up" title="(dir)">
  16 <style type="text/css">
  17 <!--
  18 a.summary-letter {text-decoration: none}
  19 blockquote.smallquotation {font-size: smaller}
  20 div.display {margin-left: 3.2em}
  21 div.example {margin-left: 3.2em}
  22 div.indentedblock {margin-left: 3.2em}
  23 div.lisp {margin-left: 3.2em}
  24 div.smalldisplay {margin-left: 3.2em}
  25 div.smallexample {margin-left: 3.2em}
  26 div.smallindentedblock {margin-left: 3.2em; font-size: smaller}
  27 div.smalllisp {margin-left: 3.2em}
  28 kbd {font-style:oblique}
  29 pre.display {font-family: inherit}
  30 pre.format {font-family: inherit}
  31 pre.menu-comment {font-family: serif}
  32 pre.menu-preformatted {font-family: serif}
  33 pre.smalldisplay {font-family: inherit; font-size: smaller}
  34 pre.smallexample {font-size: smaller}
  35 pre.smallformat {font-family: inherit; font-size: smaller}
  36 pre.smalllisp {font-size: smaller}
  37 span.nocodebreak {white-space:nowrap}
  38 span.nolinebreak {white-space:nowrap}
  39 span.roman {font-family:serif; font-weight:normal}
  40 span.sansserif {font-family:sans-serif; font-weight:normal}
  41 ul.no-bullet {list-style: none}
  42 -->
  43 </style>
  44
  45
  46 </head>
  47
  48 <body lang="en" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#800080" alink="#FF0000">
  49 <h1 class="settitle" align="center">PWMD Manual</h1>
  50
  51
  52
  53
  54 <a name="Top"></a>
  55 <div class="header">
  56 <p>
  57 Up: <a href="dir.html#Top" accesskey="u" rel="up">(dir)</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
  58 </div>
  59 <h1 class="node-heading">Top</h1>
  60
  61
  62 <table class="menu" border="0" cellspacing="0">
  63 <tr><td align="left" valign="top">&bull; <a href="#Introduction" accesskey="1">Introduction</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Overview of pwmd.
  64 </td></tr>
  65 <tr><td align="left" valign="top">&bull; <a href="#Invoking" accesskey="2">Invoking</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Command line options.
  66 </td></tr>
  67 <tr><td align="left" valign="top">&bull; <a href="#Configuration" accesskey="3">Configuration</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Configuration file options.
  68 </td></tr>
  69 <tr><td align="left" valign="top">&bull; <a href="#Commands" accesskey="4">Commands</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Protocol commands.
  70 </td></tr>
  71 <tr><td align="left" valign="top">&bull; <a href="#Status-Messages" accesskey="5">Status Messages</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Status lines and their meaning.
  72 </td></tr>
  73 <tr><td align="left" valign="top">&bull; <a href="#Target-Attribute" accesskey="6">Target Attribute</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">A kind of symbolic link.
  74 </td></tr>
  75 <tr><td align="left" valign="top">&bull; <a href="#Signals" accesskey="7">Signals</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Signals known to pwmd.
  76 </td></tr>
  77 <tr><td align="left" valign="top">&bull; <a href="#Concept-Index" accesskey="8">Concept Index</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Index of concepts.
  78 </td></tr>
  79 </table>
  80
  81 <hr>
  82 <a name="Introduction"></a>
  83 <div class="header">
  84 <p>
  85 Next: <a href="#Invoking" accesskey="n" rel="next">Invoking</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
  86 </div>
  87 <a name="Overview-of-pwmd"></a>
  88 <h2 class="chapter">1 Overview of <code>pwmd</code></h2>
  89
  90
  91
  92
  93
  94
  95 <p><code>pwmd</code> or <em>Password Manager Daemon</em> is a server that
  96 applications connect to and send commands to store and retrieve data
  97 that is saved in an encrypted <abbr>XML</abbr> document.
  98 </p>
  99 <p>The server uses the Assuan protocol (See <a href="http://www.gnupg.org/documentation/manuals/assuan/Implementation.html#Implementation">(assuan)Implementation</a>) which
 100 is the same used by <code>gpg-agent</code>, <code>pinentry</code> and
 101 <code>scdaemon</code>. It also uses <cite>libgpg-error</cite> for error reporting with
 102 the error source set as <var>GPG_ERR_SOURCE_USER_1</var>.
 103 </p>
 104
 105 <p>The <abbr>XML</abbr> document uses the following <abbr>DTD</abbr>:
 106 </p>
 107 <div class="example">
 108 <pre class="example">    &lt;?xml version=&quot;1.0&quot;?&gt;
 109     &lt;!DOCTYPE pwmd [
 110     &lt;!ELEMENT pwmd (element*)&gt;
 111     &lt;!ATTLIST element _name CDATA #REQUIRED&gt;
 112     ]&gt;
 113 </pre></div>
 114
 115 <p>The <code>pwmd</code> element is the document root node while all other elements
 116 of the document have the name <code>element</code> with an attribute <code>_name</code>
 117 whose value uniquely identifies the element at the current element tree depth.
 118 It is done this way to avoid <abbr>XML</abbr> parsing errors for commonly used
 119 characters.  A <abbr>URL</abbr> for example would be an invalid <abbr>XML</abbr> element
 120 since the <abbr>URI</abbr> contains a &lsquo;<samp>:</samp>&rsquo; which is also the <abbr>XML</abbr>
 121 namespace separator.
 122 </p>
 123 <p>As mentioned, an element name must be unique for the current element tree
 124 depth. You cannot have two elements containing the same <code>_name</code> attribute
 125 value. <code>pwmd</code> will stop searching for an element of an <em>element
 126 path</em> at the first match then continue searching for the next element of the
 127 element path beginning at the child node of the matched element.
 128 </p>
 129 <p>An <em>element path</em> is a <tt class="key">TAB</tt> delimited character string where each
 130 <tt class="key">TAB</tt> separates each element in the path.  For example, the element path
 131 <code>a<span class="key">TAB</span>b<span class="key">TAB</span>c</code> has the following <abbr>XML</abbr> document structure:
 132 </p>
 133 <div class="example">
 134 <pre class="example">   &lt;pwmd&gt;
 135             &lt;element _name=&quot;a&quot;&gt;
 136                 &lt;element _name=&quot;b&quot;&gt;
 137                     &lt;element _name=&quot;c&quot;&gt;
 138                         [... element value or content ...]
 139                     &lt;/element&gt;
 140                 &lt;/element&gt;
 141             &lt;/element&gt;
 142         &lt;/pwmd&gt;
 143 </pre></div>
 144
 145 <p>The only restriction of an element name is that it contain no whitespace
 146 characters. It also cannot begin with a &lsquo;<samp>!</samp>&rsquo; since this character is
 147 reserved for the <code>target</code> attribute. See <a href="#Target-Attribute">Target Attribute</a>.
 148 </p>
 149 <hr>
 150 <a name="Invoking"></a>
 151 <div class="header">
 152 <p>
 153 Next: <a href="#Configuration" accesskey="n" rel="next">Configuration</a>, Previous: <a href="#Introduction" accesskey="p" rel="previous">Introduction</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 154 </div>
 155 <a name="Invoking-pwmd"></a>
 156 <h2 class="chapter">2 Invoking <code>pwmd</code></h2>
 157
 158
 159
 160 <p>When <code>pwmd</code> is started with the <samp>--use-agent</samp> command
 161 line option then <code>pwmd</code> will use <code>gpg-agent</code> for key
 162 generation, decryption, signing and caching of passphrases as the
 163 default rather than symmetrically encrypted data files.
 164 <code>gpg-agent</code> must be running prior to <code>pwmd</code> startup when
 165 this option is enabled. The <code>GPG_AGENT_INFO</code> environment variable is
 166 set by <code>gpg-agent</code> and <code>pwmd</code> uses this variable to
 167 determine where the <code>gpg-agent</code> socket is listening for
 168 connections.
 169 </p>
 170 <p>It is recommended to pass the <samp>--allow-preset-passphrase</samp>
 171 command line option to <code>gpg-agent</code>. Doing so allows <code>pwmd</code>
 172 cache pushing on startup. It is also recommended to pass the
 173 <samp>--allow-loopback-pinentry</samp> to <code>gpg-agent</code>. This option allows
 174 a passphrase to be inquired from <code>pwmd</code> when a <code>pinentry</code> is
 175 unavailable to the client.
 176 </p>
 177 <a name="index-Running-pwmd"></a>
 178 <p><code>pwmd</code> is executed as follows:
 179 </p>
 180 <div class="example">
 181 <pre class="example">pwmd <var>options</var> [ file1 ] [ &hellip; ]
 182 </pre></div>
 183
 184 <p>Non-option arguments are data files to cache on startup. When the data file
 185 requires a passphrase for decryption a <code>pinentry</code> will prompt either
 186 on the current <abbr>TTY</abbr> or from an X11 window when the <code>DISPLAY</code>
 187 environment variable is set.
 188 </p>
 189 <a name="index-Options"></a>
 190 <a name="index-Arguments"></a>
 191 <p>The following command line options are supported:
 192 </p>
 193 <a name="index-Getting-help"></a>
 194 <dl compact="compact">
 195 <dt>&lsquo;<samp>--homedir directory</samp>&rsquo;</dt>
 196 <dd><p>The root directory where pwmd will store its data and temporary files.  The
 197 default is <samp>~/.pwmd</samp>.
 198 </p>
 199 </dd>
 200 <dt>&lsquo;<samp>--rcfile, -f rcfile</samp>&rsquo;</dt>
 201 <dd><p>Specify an alternate configuration file. The default is
 202 <samp>~/.pwmd/config</samp>.
 203 </p>
 204 </dd>
 205 <dt>&lsquo;<samp>--use-agent</samp>&rsquo;</dt>
 206 <dd><p>Enable the use of <code>gpg-agent</code> and add support for data files
 207 encrypted with a keypair. Files previously handled by
 208 <code>gpg-agent</code> when this option is not specified will no longer be
 209 able to be opened and new data files are symmetrically or conventionally
 210 encrypted and without a public and private key. If
 211 specified, both data file types are supported.
 212 </p>
 213 </dd>
 214 <dt>&lsquo;<samp>--import, -I filename</samp>&rsquo;</dt>
 215 <dd><p>Imports an <abbr>XML</abbr> file. The <abbr>XML</abbr> file should be in conformance to
 216 the <code>pwmd</code> <abbr>DTD</abbr> (see <a href="#Introduction">Introduction</a>). You
 217 will be prompted for a passphrase to encrypt with.  The output is written to
 218 the filename specified with <samp>--outfile</samp>. To make use of the imported
 219 data, place the output file in <samp>~/.pwmd/data</samp>.
 220 </p>
 221 </dd>
 222 <dt>&lsquo;<samp>--keyparam S-expression</samp>&rsquo;</dt>
 223 <dd><p>The key parameters to use when generating a new key pair while importing an
 224 <abbr>XML</abbr> file or when converting a <em>version 2</em> data file. The argument
 225 must be a valid S-expression (See <a href="http://www.gnupg.org/documentation/manuals/gcrypt/S_002dexpressions.html#S_002dexpressions">(gcrypt)S-expressions</a>).
 226 </p>
 227 </dd>
 228 <dt>&lsquo;<samp>--keygrip hexstring</samp>&rsquo;</dt>
 229 <dd><p>Specifies the hexadecimal encoded public key-grip to use for encryption when
 230 importing or converting. When not specified a new key-pair will be created.
 231 </p>
 232 </dd>
 233 <dt>&lsquo;<samp>--sign-keygrip hexstring</samp>&rsquo;</dt>
 234 <dd><p>Specifies the hexadecimal encoded public key-grip to use for signing of the
 235 data file when importing or converting. When not specified the generated
 236 public key or the key specified with the <samp>--keygrip</samp> option will be
 237 used.
 238 </p>
 239 </dd>
 240 <dt>&lsquo;<samp>--passphrase-file, -k filename&quot;</samp>&rsquo;</dt>
 241 <dd><p>Obtain the passphrase from the specified filename.
 242 </p>
 243 </dd>
 244 <dt>&lsquo;<samp>--s2k-count iterations</samp>&rsquo;</dt>
 245 <dd><p>The number of times to hash the passphrase when importing or converting.  The
 246 default is the gpg-agent calibrated value of the machine. When less than
 247 &lsquo;<samp>65536</samp>&rsquo; the default will be used.
 248 </p>
 249 </dd>
 250 <dt>&lsquo;<samp>--cipher-iterations iterations</samp>&rsquo;</dt>
 251 <dd><p>The number of symmetric encryption iterations. The value is actually N+1. The
 252 default is 0+1.
 253 </p>
 254 </dd>
 255 <dt>&lsquo;<samp>--cipher algo</samp>&rsquo;</dt>
 256 <dd><p>When importing, the cipher to use for data encryption.  See the <var>cipher</var>
 257 configuration parameter (see <a href="#Configuration">Configuration</a>) for available ciphers. The
 258 default is &lsquo;<samp>aes256</samp>&rsquo;.
 259 </p>
 260 </dd>
 261 <dt>&lsquo;<samp>--convert, -C filename</samp>&rsquo;</dt>
 262 <dd><p>Converts a <code>pwmd</code> <em>version 2</em> data file to a <em>version 3</em>
 263 data file. If encrypted, you will be prompted for a passphrase to use for
 264 decryption unless <samp>--passphrase-file</samp> was specified. The converted data
 265 file will be saved to the filename specified with <samp>--outfile</samp>. All
 266 <samp>--import</samp> related options may also be used when converting.
 267 </p>
 268 </dd>
 269 <dt>&lsquo;<samp>--disable-dump, -D</samp>&rsquo;</dt>
 270 <dd><p>Disable the <code>XPATH</code>, <code>XPATHATTR</code>, <code>LIST</code> and <code>DUMP</code>
 271 protocol commands (see <a href="#Commands">Commands</a>). This overrides any
 272 <var>disable_list_and_dump</var> configuration parameter (see <a href="#Configuration">Configuration</a>).
 273 </p>
 274 </dd>
 275 <dt>&lsquo;<samp>--no-fork, -n</samp>&rsquo;</dt>
 276 <dd><p>Run as a foreground process and do not fork into the background.
 277 </p>
 278 </dd>
 279 <dt>&lsquo;<samp>--ignore</samp>&rsquo;</dt>
 280 <dd><p>Ignore cache pushing failures on startup. By default, <code>pwmd</code> will exit
 281 if an error occurred do to an invalid passphrase or other error.
 282 </p>
 283 </dd>
 284 <dt>&lsquo;<samp>--debug-level keyword,keyword,...</samp>&rsquo;</dt>
 285 <dd><p>Output libassuan See <a href="http://www.gnupg.org/documentation/manuals/assuan/index.html#Top">(assuan)Top</a> protocol IO with the comma
 286 separated list of output keywords.  Valid keywords are: <code>init</code>,
 287 <code>ctx</code>, <code>engine</code>, <code>data</code>, <code>sysio</code> and <code>control</code>.
 288 </p>
 289 </dd>
 290 <dt>&lsquo;<samp>--version</samp>&rsquo;</dt>
 291 <dd><p>Show the version, copyright and compile time features and exit.
 292 </p>
 293 </dd>
 294 <dt>&lsquo;<samp>--help</samp>&rsquo;</dt>
 295 <dd><p>Print a summary of options.
 296 </p></dd>
 297 </dl>
 298
 299
 300 <hr>
 301 <a name="Configuration"></a>
 302 <div class="header">
 303 <p>
 304 Next: <a href="#TLS" accesskey="n" rel="next">TLS</a>, Previous: <a href="#Invoking" accesskey="p" rel="previous">Invoking</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 305 </div>
 306 <a name="pwmd-configuration-file-options"></a>
 307 <h2 class="chapter">3 <code>pwmd</code> configuration file options</h2>
 308
 309
 310 <p>If no configuration file is specified with the <code>pwmd</code> <samp>-f</samp>
 311 command line option, <code>pwmd</code> will read <samp>~/.pwmd/config</samp> if it
 312 exists, and if not, will use defaults.  Blank lines and lines beginning with
 313 &lsquo;<samp>#</samp>&rsquo; are ignored. Some parameters may have data file specific settings by
 314 placing them in a file section. A file section is declared by surrounding the
 315 filename with braces (i.e., &lsquo;<samp>[filename]</samp>&rsquo;).  Global options may be
 316 specified in a &lsquo;<samp>[global]</samp>&rsquo; section and are the default options for new or
 317 unspecified files.
 318 </p>
 319 <p>A tilde <tt class="key">~</tt> will be expanded to the home directory of the invoking user
 320 when contained in a parameter whose value is a filename.
 321 </p>
 322 <a name="index-Reloading-the-configuration-file"></a>
 323 <p>The configuration file can be reloaded by sending the <em>SIGHUP</em> signal to
 324 a <code>pwmd</code> process.
 325 </p>
 326 <a name="index-Global-configuration-options"></a>
 327 <p>The following options are only for use in the &lsquo;<samp>global</samp>&rsquo; section:
 328 </p>
 329 <dl compact="compact">
 330 <dt>&lsquo;<samp>socket_path = /path/to/socket</samp>&rsquo;</dt>
 331 <dd><p>Listen on the specified socket. The default is <samp>~/.pwmd/socket</samp>.
 332 </p>
 333 </dd>
 334 <dt>&lsquo;<samp>socket_perms = octal_mode</samp>&rsquo;</dt>
 335 <dd><p>Permissions to set after creating the socket. This will override any
 336 <cite>umask(2)</cite> setting.
 337 </p>
 338 </dd>
 339 <dt>&lsquo;<samp>allowed = [-]user,[-]@group,...</samp>&rsquo;</dt>
 340 <dd><p>A comma separated list of local user names or group names allowed to connect
 341 to the socket. Groups should be prefixed with a &lsquo;<samp>@</samp>&rsquo;. When not specified
 342 only the invoking user may connect. A username or group name may also be
 343 prefixed with a <tt class="key">-</tt> to prevent access to a specific user or group
 344 in the list. The order of the list is important since a user may be of
 345 multiple groups.
 346 </p>
 347 <p>This parameter may also be specified in a filename section to allow or
 348 deny a local user to <code>OPEN</code> (see <a href="#OPEN">OPEN</a>) a data file and has the
 349 same default to allow only the invoking user.
 350 </p>
 351 <p>The following example would deny all users in group <code>primary</code> but
 352 allow <code>username</code> who is a member of <code>primary</code>:
 353 </p>
 354 <div class="example">
 355 <pre class="example">allowed=-@primary,username
 356 </pre></div>
 357
 358 </dd>
 359 <dt>&lsquo;<samp>disable_mlockall = boolean</samp>&rsquo;</dt>
 360 <dd><p>When set to <var>false</var>, <cite>mlockall(2)</cite> will be called on startup.  This
 361 will use more physical memory but may also be more secure since no swapping to
 362 disk will occur. The default is <var>true</var>.
 363 </p>
 364 </dd>
 365 <dt>&lsquo;<samp>log_path = /path/to/logfile</samp>&rsquo;</dt>
 366 <dd><p>Logs informational messages to the specified file. The default is
 367 <samp>~/.pwmd/log</samp>.
 368 </p>
 369 </dd>
 370 <dt>&lsquo;<samp>enable_logging = boolean</samp>&rsquo;</dt>
 371 <dd><p>Enable or disable logging to <var>log_path</var>. The default is <code>false</code>.
 372 </p>
 373 </dd>
 374 <dt>&lsquo;<samp>syslog = boolean</samp>&rsquo;</dt>
 375 <dd><p>Enable logging to <cite>syslog(8)</cite> with facility <em>LOG_DAEMON</em> and priority
 376 <em>LOG_INFO</em>. The default is <code>false</code>.
 377 </p>
 378 </dd>
 379 <dt>&lsquo;<samp>log_level = level</samp>&rsquo;</dt>
 380 <dd><p>When <code>0</code>, only connections and errors are logged. When <code>1</code>, client
 381 commands are also logged. When <code>2</code>, the command arguments are also logged.
 382 The default is <code>0</code>.
 383 </p>
 384 </dd>
 385 <dt>&lsquo;<samp>use_agent = boolean</samp>&rsquo;</dt>
 386 <dd><p>When true, enable <code>gpg-agent</code> support (see <a href="#Invoking">Invoking</a>).
 387 </p>
 388 </dd>
 389 <dt>&lsquo;<samp>agent_env_file = filename</samp>&rsquo;</dt>
 390 <dd><p>A file containing the <code>GPG_AGENT_INFO</code> environment variable and value as
 391 output by the <code>gpg-agent</code> <samp>--write-env-file</samp> command line
 392 option.
 393 </p>
 394 </dd>
 395 <dt>&lsquo;<samp>kill_scd = boolean</samp>&rsquo;</dt>
 396 <dd><p>Kill <code>scdaemon</code> after each <code>OPEN</code> (see <a href="#OPEN">OPEN</a>) or <code>SAVE</code>
 397 (see <a href="#SAVE">SAVE</a>) command.
 398 </p>
 399 </dd>
 400 <dt>&lsquo;<samp>require_save_key = boolean</samp>&rsquo;</dt>
 401 <dd><p>Require the passphrase needed to open a data file before writing changes
 402 of the documment to disk reguardless of the key cache status.
 403 </p>
 404 </dd>
 405 <dt>&lsquo;<samp>disable_list_and_dump = boolean</samp>&rsquo;</dt>
 406 <dd><p>When <code>true</code>, the <code>XPATH</code>, <code>XPATHATTR</code>, <code>LIST</code> and
 407 <code>DUMP</code> protocol commands (see <a href="#Commands">Commands</a>) will be disabled.
 408 </p>
 409 </dd>
 410 <dt>&lsquo;<samp>cache_push = file1,file2</samp>&rsquo;</dt>
 411 <dd><p>A comma separated list of filenames that will be pushed into the file cache
 412 upon startup. <code>pwmd</code> will prompt for the passphrase for each file unless
 413 specified with the <var>passphrase</var> or <var>passphrase_file</var> parameters in a
 414 matching file section.
 415 </p>
 416 </dd>
 417 <dt>&lsquo;<samp>priority = integer</samp>&rsquo;</dt>
 418 <dd><p>The priority, or niceness, of the server. The default is inherited from the
 419 parent process.
 420 </p>
 421 </dd>
 422 <dt>&lsquo;<samp>cipher = algorithm</samp>&rsquo;</dt>
 423 <dd><p>The default cipher to use for data encryption. The algorithm must be one of:
 424 <code>aes128</code>, <code>aes192</code>, <code>aes256</code>, <code>serpent128</code>,
 425 <code>serpent192</code>, <code>serpent256</code>, <code>camellia128</code>,
 426 <code>camellia192</code>, <code>camellia256</code>, <code>3des</code>, <code>cast5</code>,
 427 <code>blowfish</code>, <code>twofish128</code> or <code>twofish256</code>. The default is
 428 <code>aes256</code>.
 429 </p>
 430 </dd>
 431 <dt>&lsquo;<samp>cipher_iterations = integer</samp>&rsquo;</dt>
 432 <dd><p>The number of times to encrypt the XML data. This differs from the
 433 <var>s2k_count</var> parameter which specifies the number of times to hash the
 434 passphrase used to encrypt the data. The default is 0 although 1 iteration is
 435 still done.
 436 </p>
 437 </dd>
 438 <dt>&lsquo;<samp>cipher_progress = integer</samp>&rsquo;</dt>
 439 <dd><p>Send a progress message to the client after the specified amount of encryption
 440 or decryption iterations have been done. The default is 2000.
 441 </p>
 442 </dd>
 443 <dt>&lsquo;<samp>keyparam = s-expression</samp>&rsquo;</dt>
 444 <dd><p>The default key paramaters to use when generating a new key-pair. The
 445 default is RSA with 2048 bits. Note that only RSA as the encryption
 446 algorithm is supported at the moment. Both RSA and DSA keys may be used
 447 for signing.
 448 </p>
 449 </dd>
 450 <dt>&lsquo;<samp>pinentry_path = /path/to/pinentry</samp>&rsquo;</dt>
 451 <dd><p>The location of the <code>pinentry</code> binary. This program is used to
 452 prompt for a passphrase when not using <code>gpg-agent</code>. The default
 453 is specified at compile time.
 454 </p>
 455 </dd>
 456 <dt>&lsquo;<samp>pinentry_timeout = seconds</samp>&rsquo;</dt>
 457 <dd><p>The number of seconds to wait for a pinentry before giving up and
 458 returning an error. This timeout value is used for both waiting for
 459 another pinentry to complete and for the pinentry waiting for user input.
 460 </p></dd>
 461 </dl>
 462
 463 <a name="index-Data-file-configuration-options"></a>
 464 <p>The following options are defaults for new files when specified in the
 465 &lsquo;<samp>global</samp>&rsquo; section. When placed in a data file section they are options
 466 specific to that data file only.
 467 </p>
 468 <dl compact="compact">
 469 <dt>&lsquo;<samp>backup = boolean</samp>&rsquo;</dt>
 470 <dd><p>Whether to create a backup of the data file when saving. The backup filename
 471 has the <samp>.backup</samp> extension appended to the opened file. The default is
 472 <code>true</code>.
 473 </p>
 474 </dd>
 475 <dt>&lsquo;<samp>cache_timeout = seconds</samp>&rsquo;</dt>
 476 <dd><p>The number of seconds to keep the cache entry for this file. If <code>-1</code>, the
 477 cache entry is kept forever. If <code>0</code>, each time an encrypted file is
 478 <code>OPEN</code>ed (see <a href="#OPEN">OPEN</a>) a passphrase will be required. The default
 479 is <code>600</code> or 10 minutes.
 480 </p>
 481 </dd>
 482 <dt>&lsquo;<samp>xfer_progress = bytes</samp>&rsquo;</dt>
 483 <dd><p>Commands that send data lines to the client will also send the <code>XFER</code>
 484 status message (see <a href="#Status-Messages">Status Messages</a>) after the specified number of bytes
 485 have been sent. The number of bytes is rounded to <var>ASSUAN_LINELENGTH</var> or
 486 <code>1002</code> bytes. The default is <code>8196</code>.
 487 </p>
 488 </dd>
 489 <dt>&lsquo;<samp>passphrase = string</samp>&rsquo;</dt>
 490 <dd><p>The passphrase to use for this file. If specified in the &lsquo;<samp>global</samp>&rsquo; section
 491 then &lsquo;<samp>global</samp>&rsquo; is treated as a data filename and not a default for other
 492 files. Note that if a client changes the passphrase for this data file then
 493 this value is not modified and will need to be updated.
 494 </p>
 495 </dd>
 496 <dt>&lsquo;<samp>passphrase_file = /path/to/file</samp>&rsquo;</dt>
 497 <dd><p>Same as the <var>passphrase</var> parameter above but obtains the passphrase from
 498 the specified filename.
 499 </p>
 500 </dd>
 501 <dt>&lsquo;<samp>recursion_depth = integer</samp>&rsquo;</dt>
 502 <dd><p>The maximum number of times to resolve a <code>target</code> attribute for an
 503 element in an element path (see <a href="#Target-Attribute">Target Attribute</a>). An error is returned
 504 when this value is exceeded.  The default is <code>100</code> but can be disabled by
 505 setting to <code>0</code> (<em>not recommended</em>).
 506 </p>
 507 </dd>
 508 <dt>&lsquo;<samp>allowed = [-]user,[-]@group,...</samp>&rsquo;</dt>
 509 <dd><p>Same parameter value as the <code>allowed</code> parameter mentioned above in
 510 the &lsquo;<samp>global</samp>&rsquo; section but grants or denies a local user from opening
 511 a specific data file. The default is to allow only the invoking user.
 512 </p>
 513 </dd>
 514 </dl>
 515 <table class="menu" border="0" cellspacing="0">
 516 <tr><td align="left" valign="top">&bull; <a href="#TLS" accesskey="1">TLS</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Remote connections over TLS.
 517 </td></tr>
 518 <tr><td align="left" valign="top">&bull; <a href="#Pinentry" accesskey="2">Pinentry</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">Configuration file and defaults.
 519 </td></tr>
 520 </table>
 521
 522 <hr>
 523 <a name="TLS"></a>
 524 <div class="header">
 525 <p>
 526 Next: <a href="#Pinentry" accesskey="n" rel="next">Pinentry</a>, Previous: <a href="#Configuration" accesskey="p" rel="previous">Configuration</a>, Up: <a href="#Configuration" accesskey="u" rel="up">Configuration</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 527 </div>
 528 <a name="Configuring-remote-connections-over-TLS_002e"></a>
 529 <h2 class="chapter">4 Configuring remote connections over TLS.</h2>
 530 <p>Remote connections can also be made to <code>pwmd</code> over <abbr>TLS</abbr>.
 531 Authentication is done by using X509 client certificates that are signed with
 532 the same Certificate Authority (<abbr>CA</abbr>) as the server certificate.
 533 </p>
 534 <p>The <abbr>CA</abbr> certificate is expected to be found in
 535 <samp>~/.pwmd/ca-cert.pem</samp> while the <code>pwmd</code> server certificate and key
 536 file should be put in <samp>~/.pwmd/server-cert.pem</samp> and
 537 <samp>~/.pwmd/server-key.pem</samp>, respectively.
 538 </p>
 539 <p>See the documentation of <code>certtool</code> or <code>openssl</code> for details
 540 on creating self-signed certificates.
 541 </p>
 542 <p>The following TLS configuration options are available:
 543 </p>
 544 <dl compact="compact">
 545 <dt>&lsquo;<samp>enable_tcp = boolean</samp>&rsquo;</dt>
 546 <dd><p>Whether to enable TCP/TLS server support. If enabled, both TCP and the local
 547 unix domain socket will listen for connections. The default is
 548 <code>false</code>.
 549 </p>
 550 </dd>
 551 <dt>&lsquo;<samp>tcp_port = integer</samp>&rsquo;</dt>
 552 <dd><p>The TCP port to listen on when <var>enable_tcp</var> is <code>true</code>. The default is
 553 <code>6466</code>.
 554 </p>
 555 </dd>
 556 <dt>&lsquo;<samp>tcp_bind = string</samp>&rsquo;</dt>
 557 <dd><p>The internet protocol to listen with. Must be one of <code>ipv4</code>, <code>ipv6</code>
 558 or <code>any</code> to listen for both IPv4 and IPv6 connections.
 559 </p>
 560 </dd>
 561 <dt>&lsquo;<samp>tcp_interface = string</samp>&rsquo;</dt>
 562 <dd><p>Only useful if running as root.
 563 </p>
 564 </dd>
 565 <dt>&lsquo;<samp>tls_timeout = seconds</samp>&rsquo;</dt>
 566 <dd><p>The number of seconds to wait for a read() or write() call on a
 567 <abbr>TLS</abbr> client file descriptor to complete before returning an
 568 error. The default is <var>300</var>.
 569 </p>
 570 <p>Note that the <code>SAVE</code> command (see <a href="#SAVE">SAVE</a>) may take a longer time
 571 to complete than other commands since key generation may need to be done
 572 or do to a large <samp>--cipher-iterations</samp> setting.
 573 </p>
 574 </dd>
 575 <dt>&lsquo;<samp>keepalive_interval = seconds</samp>&rsquo;</dt>
 576 <dd><p>Send a keepalive status message to an idle remote client.  An idle
 577 client is one who is not in a command. The purpose of this status
 578 message is to disconnect a hung remote client and release any file mutex
 579 locks so another client may open the same data file. The default is <code>60</code>.
 580 </p>
 581 </dd>
 582 <dt>&lsquo;<samp>tls_access = [+][!-]string[,[!-]string,...]</samp>&rsquo;</dt>
 583 <dd><p>A comma separated list of client X509 certificate fingerprints in SHA-1
 584 format that will be allowed to connect or open a file. If prefixed with
 585 <code>!</code> or <code>-</code> then access is denied for the fingerprint. When
 586 <code>!</code> or <code>-</code> is found by itself in the list it is treated as a
 587 default for remaining fingerprints in the list. The <code>+</code> prefix
 588 behaves the same but allows access. The order of the list is important
 589 meaning that of one or more fingerprints of the same SHA-1 hash, only
 590 the final in the list is considered.
 591 </p>
 592 <p>The access control is two fold: when the client connects its SHA-1
 593 fingerprint is matched against the list of allowed fingerprints in the
 594 &lsquo;<samp>global</samp>&rsquo; section. When allowed in the &lsquo;<samp>global</samp>&rsquo; section the
 595 connection is established and the client may proceed to <code>OPEN</code>
 596 (see <a href="#OPEN">OPEN</a>) a data file. During the <code>OPEN</code>, <code>CLEARCACHE</code>
 597 and <code>CACHETIMEOUT</code> commands, the
 598 fingerprint is checked again in a &lsquo;<samp>filename</samp>&rsquo; section. When this
 599 parameter is not found in a &lsquo;<samp>filename</samp>&rsquo; section then access is
 600 granted.
 601 </p>
 602 </dd>
 603 <dt>&lsquo;<samp>tcp_require_key = boolean</samp>&rsquo;</dt>
 604 <dd><p>When <code>true</code>, require the remote client to provide the key or passphrase
 605 to open a data file even if the file is cached. Note that the cache entry is
 606 cleared during the see <a href="#OPEN">OPEN</a> command and the passphrase will be retrieved
 607 from the client via a server <em>INQUIRE</em>. This option is a default
 608 for all files when specified in the &lsquo;<samp>global</samp>&rsquo; section. The default
 609 is <code>false</code>.
 610 </p>
 611 </dd>
 612 <dt>&lsquo;<samp>tcp_wait = integer</samp>&rsquo;</dt>
 613 <dd><p>The time in tenths of a second to wait between TCP connections.  Setting to 0
 614 will disable waiting. The default is <code>3</code>.
 615 </p>
 616 </dd>
 617 <dt>&lsquo;<samp>tls_cipher_suite = string</samp>&rsquo;</dt>
 618 <dd><p>The GnuTLS cipher suite and protocol to use. See the GnuTLS documentation for
 619 information about the format of this string. The default is <code>SECURE256</code>.
 620 </p></dd>
 621 </dl>
 622
 623 <hr>
 624 <a name="Pinentry"></a>
 625 <div class="header">
 626 <p>
 627 Next: <a href="#Commands" accesskey="n" rel="next">Commands</a>, Previous: <a href="#TLS" accesskey="p" rel="previous">TLS</a>, Up: <a href="#Configuration" accesskey="u" rel="up">Configuration</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 628 </div>
 629 <a name="Pinentry-configuration"></a>
 630 <h2 class="chapter">5 Pinentry configuration</h2>
 631
 632 <p>The <code>pinentry</code> program is used to prompt the user for passphrase
 633 input or as a confirmation dialog; it needs to know where to prompt for
 634 the input, beit from a terminal or an X11 display.
 635 </p>
 636 <p>It is the responsibility of the client to tell <code>pinentry</code> about
 637 the terminal or X11 display before requiring the input. This is done by
 638 using the <code>pwmd</code> see <a href="#OPTION">OPTION</a> protocol command. It need be
 639 done only once per client connection. To avoid the use of
 640 <code>pinentry</code> entirely, use the <code>OPTION</code> (see <a href="#OPTION">OPTION</a>)
 641 <samp>--disable-pinentry</samp> protocol command.
 642 </p>
 643 <hr>
 644 <a name="Commands"></a>
 645 <div class="header">
 646 <p>
 647 Next: <a href="#Status-Messages" accesskey="n" rel="next">Status Messages</a>, Previous: <a href="#Pinentry" accesskey="p" rel="previous">Pinentry</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 648 </div>
 649 <a name="Protocol-commands-and-their-syntax"></a>
 650 <h2 class="chapter">6 Protocol commands and their syntax</h2>
 651 <table class="menu" border="0" cellspacing="0">
 652 <tr><td align="left" valign="top">&bull; <a href="#AGENT" accesskey="1">AGENT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 653 </td></tr>
 654 <tr><td align="left" valign="top">&bull; <a href="#ATTR" accesskey="2">ATTR</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 655 </td></tr>
 656 <tr><td align="left" valign="top">&bull; <a href="#CACHETIMEOUT" accesskey="3">CACHETIMEOUT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 657 </td></tr>
 658 <tr><td align="left" valign="top">&bull; <a href="#CLEARCACHE" accesskey="4">CLEARCACHE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 659 </td></tr>
 660 <tr><td align="left" valign="top">&bull; <a href="#COPY" accesskey="5">COPY</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 661 </td></tr>
 662 <tr><td align="left" valign="top">&bull; <a href="#DELETE" accesskey="6">DELETE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 663 </td></tr>
 664 <tr><td align="left" valign="top">&bull; <a href="#DUMP" accesskey="7">DUMP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 665 </td></tr>
 666 <tr><td align="left" valign="top">&bull; <a href="#GET" accesskey="8">GET</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 667 </td></tr>
 668 <tr><td align="left" valign="top">&bull; <a href="#GETCONFIG" accesskey="9">GETCONFIG</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 669 </td></tr>
 670 <tr><td align="left" valign="top">&bull; <a href="#GETINFO">GETINFO</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 671 </td></tr>
 672 <tr><td align="left" valign="top">&bull; <a href="#HELP">HELP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 673 </td></tr>
 674 <tr><td align="left" valign="top">&bull; <a href="#IMPORT">IMPORT</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 675 </td></tr>
 676 <tr><td align="left" valign="top">&bull; <a href="#ISCACHED">ISCACHED</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 677 </td></tr>
 678 <tr><td align="left" valign="top">&bull; <a href="#KEYGRIP">KEYGRIP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 679 </td></tr>
 680 <tr><td align="left" valign="top">&bull; <a href="#LIST">LIST</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 681 </td></tr>
 682 <tr><td align="left" valign="top">&bull; <a href="#LOCK">LOCK</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 683 </td></tr>
 684 <tr><td align="left" valign="top">&bull; <a href="#LS">LS</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 685 </td></tr>
 686 <tr><td align="left" valign="top">&bull; <a href="#MOVE">MOVE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 687 </td></tr>
 688 <tr><td align="left" valign="top">&bull; <a href="#NOP">NOP</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 689 </td></tr>
 690 <tr><td align="left" valign="top">&bull; <a href="#OPEN">OPEN</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 691 </td></tr>
 692 <tr><td align="left" valign="top">&bull; <a href="#OPTION">OPTION</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 693 </td></tr>
 694 <tr><td align="left" valign="top">&bull; <a href="#PASSWD">PASSWD</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 695 </td></tr>
 696 <tr><td align="left" valign="top">&bull; <a href="#REALPATH">REALPATH</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 697 </td></tr>
 698 <tr><td align="left" valign="top">&bull; <a href="#RENAME">RENAME</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 699 </td></tr>
 700 <tr><td align="left" valign="top">&bull; <a href="#RESET">RESET</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 701 </td></tr>
 702 <tr><td align="left" valign="top">&bull; <a href="#SAVE">SAVE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 703 </td></tr>
 704 <tr><td align="left" valign="top">&bull; <a href="#STORE">STORE</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 705 </td></tr>
 706 <tr><td align="left" valign="top">&bull; <a href="#UNLOCK">UNLOCK</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 707 </td></tr>
 708 <tr><td align="left" valign="top">&bull; <a href="#XPATH">XPATH</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 709 </td></tr>
 710 <tr><td align="left" valign="top">&bull; <a href="#XPATHATTR">XPATHATTR</a>:</td><td>&nbsp;&nbsp;</td><td align="left" valign="top">
 711 </td></tr>
 712 </table>
 713 <hr>
 714 <a name="AGENT"></a>
 715 <div class="header">
 716 <p>
 717 Next: <a href="#ATTR" accesskey="n" rel="next">ATTR</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 718 </div>
 719 <a name="AGENT-command"></a>
 720 <h2 class="chapter">7 AGENT command</h2>
 721 <a name="index-AGENT-command"></a>
 722 <p>Syntax:
 723 </p><div class="example">
 724 <pre class="example">AGENT &lt;command&gt;
 725 </pre></div>
 726
 727 <p>Send a <code>gpg-agent</code> protocol <var>command</var> directly to the
 728 <code>gpg-agent</code>.
 729 </p>
 730
 731 <hr>
 732 <a name="ATTR"></a>
 733 <div class="header">
 734 <p>
 735 Next: <a href="#CACHETIMEOUT" accesskey="n" rel="next">CACHETIMEOUT</a>, Previous: <a href="#AGENT" accesskey="p" rel="previous">AGENT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 736 </div>
 737 <a name="ATTR-command"></a>
 738 <h2 class="chapter">8 ATTR command</h2>
 739 <a name="index-ATTR-command"></a>
 740 <p>Syntax:
 741 </p><div class="example">
 742 <pre class="example">ATTR [--inquire] SET|GET|DELETE|LIST [&lt;attribute&gt;] [!]element[&lt;TAB&gt;[!]child[..]] ..
 743 </pre></div>
 744
 745 <dl compact="compact">
 746 <dt>ATTR SET attribute [!]element[&lt;TAB&gt;[!]child[..]] [value]</dt>
 747 <dd>
 748 <p>Stores or updates an <var>attribute</var> name and optional <var>value</var> of an
 749 element. When no <var>value</var> is specified any existing value will be removed.
 750 </p>
 751 </dd>
 752 <dt>ATTR DELETE attribute [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 753 <dd>
 754 <p>Removes an <var>attribute</var> from an element.
 755 </p>
 756 </dd>
 757 <dt>ATTR LIST [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 758 <dd>
 759 <p>Retrieves a newline separated list of attributes names and values
 760 from the specified element. Each attribute name and value is space delimited.
 761 </p>
 762 </dd>
 763 <dt>ATTR GET attribute [!]element[&lt;TAB&gt;[!]child[..]]</dt>
 764 <dd>
 765 <p>Retrieves the value of an <var>attribute</var> from an element.
 766 </p></dd>
 767 </dl>
 768
 769 <p>The <code>_name</code> attribute (case sensitive) cannot be removed nor modified.
 770 Use the <code>DELETE</code> (see <a href="#DELETE">DELETE</a>) or <code>RENAME</code> (see <a href="#RENAME">RENAME</a>)
 771 commands instead.
 772 </p>
 773 <p>The <code>_mtime</code> attribute is updated each time an element is modified by
 774 either storing content, editing attributes or by deleting a child element.
 775 The <code>_ctime</code> attribute is created for each new element in an element
 776 path.
 777 </p>
 778 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 779 arguments are retrieved via a server <em>INQUIRE</em>.
 780 </p>
 781 <p>See <a href="#Target-Attribute">Target Attribute</a>, for details about this special attribute.
 782 </p>
 783
 784 <hr>
 785 <a name="CACHETIMEOUT"></a>
 786 <div class="header">
 787 <p>
 788 Next: <a href="#CLEARCACHE" accesskey="n" rel="next">CLEARCACHE</a>, Previous: <a href="#ATTR" accesskey="p" rel="previous">ATTR</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 789 </div>
 790 <a name="CACHETIMEOUT-command"></a>
 791 <h2 class="chapter">9 CACHETIMEOUT command</h2>
 792 <a name="index-CACHETIMEOUT-command"></a>
 793 <p>Syntax:
 794 </p><div class="example">
 795 <pre class="example">CACHETIMEOUT &lt;filename&gt; &lt;seconds&gt;
 796 </pre></div>
 797
 798 <p>The time in <var>seconds</var> until <var>filename</var> will be removed from the
 799 cache. <code>-1</code> will keep the cache entry forever, <code>0</code> will require
 800 the passphrase for each <code>OPEN</code> or <code>SAVE</code> command (see <a href="#OPEN">OPEN</a>,
 801 see <a href="#SAVE">SAVE</a>). See <a href="#Configuration">Configuration</a>, and the <code>cache_timeout</code>
 802 parameter.
 803 </p>
 804
 805 <hr>
 806 <a name="CLEARCACHE"></a>
 807 <div class="header">
 808 <p>
 809 Next: <a href="#COPY" accesskey="n" rel="next">COPY</a>, Previous: <a href="#CACHETIMEOUT" accesskey="p" rel="previous">CACHETIMEOUT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 810 </div>
 811 <a name="CLEARCACHE-command"></a>
 812 <h2 class="chapter">10 CLEARCACHE command</h2>
 813 <a name="index-CLEARCACHE-command"></a>
 814 <p>Syntax:
 815 </p><div class="example">
 816 <pre class="example">CLEARCACHE [&lt;filename&gt;]
 817 </pre></div>
 818
 819 <p>Clears a file cache entry for all or the specified <var>filename</var>.
 820 </p>
 821
 822 <hr>
 823 <a name="COPY"></a>
 824 <div class="header">
 825 <p>
 826 Next: <a href="#DELETE" accesskey="n" rel="next">DELETE</a>, Previous: <a href="#CLEARCACHE" accesskey="p" rel="previous">CLEARCACHE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 827 </div>
 828 <a name="COPY-command"></a>
 829 <h2 class="chapter">11 COPY command</h2>
 830 <a name="index-COPY-command"></a>
 831 <p>Syntax:
 832 </p><div class="example">
 833 <pre class="example">COPY [--inquire] [!]source[&lt;TAB&gt;[!]child[..]] [!]dest[&lt;TAB&gt;[!]child[..]]
 834 </pre></div>
 835
 836 <p>Copies the entire element tree starting from the child node of the source
 837 element, to the destination element path. If the destination element path
 838 does not exist then it will be created; otherwise it is overwritten.
 839 </p>
 840 <p>Note that attributes from the source element are merged into the
 841 destination element when the destination element path exists. When an
 842 attribute of the same name exists in both the source and destination
 843 elements then the destination attribute will be updated to the source
 844 attribute value.
 845 </p>
 846 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 847 arguments are retrieved via a server <em>INQUIRE</em>.
 848 </p>
 849
 850 <hr>
 851 <a name="DELETE"></a>
 852 <div class="header">
 853 <p>
 854 Next: <a href="#DUMP" accesskey="n" rel="next">DUMP</a>, Previous: <a href="#COPY" accesskey="p" rel="previous">COPY</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 855 </div>
 856 <a name="DELETE-command"></a>
 857 <h2 class="chapter">12 DELETE command</h2>
 858 <a name="index-DELETE-command"></a>
 859 <p>Syntax:
 860 </p><div class="example">
 861 <pre class="example">DELETE [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
 862 </pre></div>
 863
 864 <p>Removes the specified element path and all of its children. This may break
 865 an element with a <code>target</code> attribute (see <a href="#Target-Attribute">Target Attribute</a>) that
 866 refers to this element or any of its children.
 867 </p>
 868 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 869 arguments are retrieved via a server <em>INQUIRE</em>.
 870 </p>
 871
 872 <hr>
 873 <a name="DUMP"></a>
 874 <div class="header">
 875 <p>
 876 Next: <a href="#GET" accesskey="n" rel="next">GET</a>, Previous: <a href="#DELETE" accesskey="p" rel="previous">DELETE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 877 </div>
 878 <a name="DUMP-command"></a>
 879 <h2 class="chapter">13 DUMP command</h2>
 880 <a name="index-DUMP-command"></a>
 881 <p>Syntax:
 882 </p><div class="example">
 883 <pre class="example">DUMP
 884 </pre></div>
 885
 886 <p>Shows the in memory <abbr>XML</abbr> document with indenting. See <a href="#XPATH">XPATH</a>, for
 887 dumping a specific node.
 888 </p>
 889
 890 <hr>
 891 <a name="GET"></a>
 892 <div class="header">
 893 <p>
 894 Next: <a href="#GETCONFIG" accesskey="n" rel="next">GETCONFIG</a>, Previous: <a href="#DUMP" accesskey="p" rel="previous">DUMP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 895 </div>
 896 <a name="GET-command"></a>
 897 <h2 class="chapter">14 GET command</h2>
 898 <a name="index-GET-command"></a>
 899 <p>Syntax:
 900 </p><div class="example">
 901 <pre class="example">GET [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
 902 </pre></div>
 903
 904 <p>Retrieves the content of the specified element. The content is returned
 905 with a data response.
 906 </p>
 907 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
 908 arguments are retrieved via a server <em>INQUIRE</em>.
 909 </p>
 910
 911 <hr>
 912 <a name="GETCONFIG"></a>
 913 <div class="header">
 914 <p>
 915 Next: <a href="#GETINFO" accesskey="n" rel="next">GETINFO</a>, Previous: <a href="#GET" accesskey="p" rel="previous">GET</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 916 </div>
 917 <a name="GETCONFIG-command"></a>
 918 <h2 class="chapter">15 GETCONFIG command</h2>
 919 <a name="index-GETCONFIG-command"></a>
 920 <p>Syntax:
 921 </p><div class="example">
 922 <pre class="example">GETCONFIG [filename] &lt;parameter&gt;
 923 </pre></div>
 924
 925 <p>Returns the value of a <code>pwmd</code> configuration <var>parameter</var> with a
 926 data response. If no file has been opened then the value for <var>filename</var>
 927 or the default from the &lsquo;<samp>global</samp>&rsquo; section will be returned. If a file
 928 has been opened and no <var>filename</var> is specified, a value previously
 929 set with the <code>OPTION</code> command (see <a href="#OPTION">OPTION</a>) will be returned.
 930 </p>
 931
 932 <hr>
 933 <a name="GETINFO"></a>
 934 <div class="header">
 935 <p>
 936 Next: <a href="#HELP" accesskey="n" rel="next">HELP</a>, Previous: <a href="#GETCONFIG" accesskey="p" rel="previous">GETCONFIG</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 937 </div>
 938 <a name="GETINFO-command"></a>
 939 <h2 class="chapter">16 GETINFO command</h2>
 940 <a name="index-GETINFO-command"></a>
 941 <p>Syntax:
 942 </p><div class="example">
 943 <pre class="example">GETINFO [--data] CACHE | CLIENTS | PID | LAST_ERROR | VERSION
 944 </pre></div>
 945
 946 <p>Get server and other information: <var>cache</var> returns the number of cached
 947 documents via a status message. <var>clients</var> returns the number of
 948 connected clients via a status message. <var>pid</var> returns the process ID
 949 number of the server via a data response. <var>VERSION</var> returns the server
 950 version number and compile-time features with a data response with each
 951 being space delimited. <var>LAST_ERROR</var> returns a detailed description of
 952 the last failed command when available. See <a href="#Status-Messages">Status Messages</a>.
 953 </p>
 954 <p>When the <samp>--data</samp> option is specified then the result will be sent
 955 via a data response rather than a status message.
 956 </p>
 957
 958 <hr>
 959 <a name="HELP"></a>
 960 <div class="header">
 961 <p>
 962 Next: <a href="#IMPORT" accesskey="n" rel="next">IMPORT</a>, Previous: <a href="#GETINFO" accesskey="p" rel="previous">GETINFO</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 963 </div>
 964 <a name="HELP-command"></a>
 965 <h2 class="chapter">17 HELP command</h2>
 966 <a name="index-HELP-command"></a>
 967 <p>Syntax:
 968 </p><div class="example">
 969 <pre class="example">HELP [&lt;COMMAND&gt;]
 970 </pre></div>
 971
 972 <p>Show available commands or command specific help text.
 973 </p>
 974
 975 <hr>
 976 <a name="IMPORT"></a>
 977 <div class="header">
 978 <p>
 979 Next: <a href="#ISCACHED" accesskey="n" rel="next">ISCACHED</a>, Previous: <a href="#HELP" accesskey="p" rel="previous">HELP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
 980 </div>
 981 <a name="IMPORT-command"></a>
 982 <h2 class="chapter">18 IMPORT command</h2>
 983 <a name="index-IMPORT-command"></a>
 984 <p>Syntax:
 985 </p><div class="example">
 986 <pre class="example">IMPORT [--root [!]element[&lt;TAB&gt;[!]child[..]]] &lt;content&gt;
 987 </pre></div>
 988
 989 <p>This command uses a server <em>INQUIRE</em> to retrieve data from the client.
 990 </p>
 991 <p>Like the <code>STORE</code> command (see <a href="#STORE">STORE</a>), but the <var>content</var>
 992 argument is raw <abbr>XML</abbr> data. The content is created as a child of
 993 the element path specified with the <samp>--root</samp> option or at the
 994 document root when not specified. Existing elements of the same name will
 995 be overwritten.
 996 </p>
 997 <p>The content must begin with an <abbr>XML</abbr> element node. See <a href="#Introduction">Introduction</a>,
 998 for details.
 999 </p>
1000
1001 <hr>
1002 <a name="ISCACHED"></a>
1003 <div class="header">
1004 <p>
1005 Next: <a href="#KEYGRIP" accesskey="n" rel="next">KEYGRIP</a>, Previous: <a href="#IMPORT" accesskey="p" rel="previous">IMPORT</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1006 </div>
1007 <a name="ISCACHED-command"></a>
1008 <h2 class="chapter">19 ISCACHED command</h2>
1009 <a name="index-ISCACHED-command"></a>
1010 <p>Syntax:
1011 </p><div class="example">
1012 <pre class="example">ISCACHED [--lock] &lt;filename&gt;
1013 </pre></div>
1014
1015 <p>An <em>OK</em> response is returned if the specified <var>filename</var> is found
1016 in the file cache. If not found in the cache but exists on the filesystem
1017 then <var>GPG_ERR_NO_DATA</var> is returned. Otherwise a filesystem error is
1018 returned.
1019 </p>
1020 <p>The <samp>lock</samp> option will lock the file mutex of <var>filename</var> when the
1021 file exists; it does not need to be opened nor cached.
1022 </p>
1023
1024 <hr>
1025 <a name="KEYGRIP"></a>
1026 <div class="header">
1027 <p>
1028 Next: <a href="#LIST" accesskey="n" rel="next">LIST</a>, Previous: <a href="#ISCACHED" accesskey="p" rel="previous">ISCACHED</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1029 </div>
1030 <a name="KEYGRIP-command"></a>
1031 <h2 class="chapter">20 KEYGRIP command</h2>
1032 <a name="index-KEYGRIP-command"></a>
1033 <p>Syntax:
1034 </p><div class="example">
1035 <pre class="example">KEYGRIP [--sign] &lt;filename&gt;
1036 </pre></div>
1037
1038 <p>Returns the hex encoded keygrip of the specified <var>filename</var> with a
1039 data response.
1040 </p>
1041 <p>When the <samp>--sign</samp> option is specified then the key used for signing
1042 of the specified <var>filename</var> will be returned.
1043 </p>
1044 <p>For symmetrically encrypted data files this command returns the error
1045 GPG_ERR_NOT_SUPPORTED.
1046 </p>
1047
1048 <hr>
1049 <a name="LIST"></a>
1050 <div class="header">
1051 <p>
1052 Next: <a href="#LOCK" accesskey="n" rel="next">LOCK</a>, Previous: <a href="#KEYGRIP" accesskey="p" rel="previous">KEYGRIP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1053 </div>
1054 <a name="LIST-command"></a>
1055 <h2 class="chapter">21 LIST command</h2>
1056 <a name="index-LIST-command"></a>
1057 <p>Syntax:
1058 </p><div class="example">
1059 <pre class="example">LIST [--inquire] [--no-recurse] [--verbose] [--with-target] [--all] [[!]element[&lt;TAB&gt;[!]child[..]]]
1060 </pre></div>
1061
1062 <p>If no element path is given then a newline separated list of root elements
1063 is returned with a data response. If given, then all reachable elements
1064 of the specified element path are returned unless the <samp>--no-recurse</samp>
1065 option is specified. If specified, only the child elements of the element
1066 path are returned without recursing into grandchildren. Each resulting
1067 element is prefixed with the literal <code>!</code> character when the element
1068 contains no <code>target</code> attribute. See <a href="#Target-Attribute">Target Attribute</a>, for details.
1069 </p>
1070 <p>When the <samp>--verbose</samp> option is passed then each element path
1071 returned will have zero or more flags appened to it. These flags are
1072 delimited from the element path by a single space character. A flag itself
1073 is a single character. Flag <code>+</code> indicates that there are child nodes of
1074 the current element path. Flag <code>E</code> indicates that an element of an
1075 element path contained in a <var>target</var> attribute could not be found. Flag
1076 <code>O</code> indicates that a <var>target</var> attribute recursion limit was reached
1077 (see <a href="#Configuration">Configuration</a>). Flag <code>T</code> will append the resolved element path
1078 of the <var>target</var> attribute contained in the current element (see below).
1079 </p>
1080 <p>The <samp>--with-target</samp> option implies <samp>--verbose</samp> and will append
1081 an additional flag <code>T</code> followed by a single space then an element path.
1082 The appended element path is the resolved path (see <a href="#REALPATH">REALPATH</a>) of the
1083 current element when it contains a <var>target</var> attribute. When no
1084 <var>target</var> attribute is found then no flag will be appended.
1085 </p>
1086 <p>The <samp>--no-recurse</samp> option limits the amount of data returned to only
1087 the listing of children of the specified element path and not any
1088 grandchildren.
1089 </p>
1090 <p>The <samp>--all</samp> option lists the entire element tree for each root
1091 element. This option also implies option <samp>--verbose</samp>.
1092 </p>
1093 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1094 arguments are retrieved via a server <em>INQUIRE</em>.
1095 </p>
1096
1097 <hr>
1098 <a name="LOCK"></a>
1099 <div class="header">
1100 <p>
1101 Next: <a href="#LS" accesskey="n" rel="next">LS</a>, Previous: <a href="#LIST" accesskey="p" rel="previous">LIST</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1102 </div>
1103 <a name="LOCK-command"></a>
1104 <h2 class="chapter">22 LOCK command</h2>
1105 <a name="index-LOCK-command"></a>
1106 <p>Syntax:
1107 </p><div class="example">
1108 <pre class="example">LOCK
1109 </pre></div>
1110
1111 <p>Locks the mutex associated with the opened file. This prevents other clients
1112 from sending commands to the same opened file until the client
1113 that sent this command either disconnects or sends the <code>UNLOCK</code>
1114 command. See <a href="#UNLOCK">UNLOCK</a>.
1115 </p>
1116
1117 <hr>
1118 <a name="LS"></a>
1119 <div class="header">
1120 <p>
1121 Next: <a href="#MOVE" accesskey="n" rel="next">MOVE</a>, Previous: <a href="#LOCK" accesskey="p" rel="previous">LOCK</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1122 </div>
1123 <a name="LS-command"></a>
1124 <h2 class="chapter">23 LS command</h2>
1125 <a name="index-LS-command"></a>
1126 <p>Syntax:
1127 </p><div class="example">
1128 <pre class="example">LS
1129 </pre></div>
1130
1131 <p>Lists the available data files stored in the data directory
1132 (<samp>~/.pwmd/data</samp>). The result is a newline separated list of filenames.
1133 </p>
1134
1135 <hr>
1136 <a name="MOVE"></a>
1137 <div class="header">
1138 <p>
1139 Next: <a href="#NOP" accesskey="n" rel="next">NOP</a>, Previous: <a href="#LS" accesskey="p" rel="previous">LS</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1140 </div>
1141 <a name="MOVE-command"></a>
1142 <h2 class="chapter">24 MOVE command</h2>
1143 <a name="index-MOVE-command"></a>
1144 <p>Syntax:
1145 </p><div class="example">
1146 <pre class="example">MOVE [--inquire] [!]source[&lt;TAB&gt;[!]child[..]] [[!]dest[&lt;TAB&gt;[!]child[..]]]
1147 </pre></div>
1148
1149 <p>Moves the source element path to the destination element path. If the
1150 destination is not specified then it will be moved to the root node of the
1151 document. If the destination is specified and exists then it will be
1152 overwritten; otherwise non-existing elements of the destination element
1153 path will be created.
1154 </p>
1155 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1156 arguments are retrieved via a server <em>INQUIRE</em>.
1157 </p>
1158
1159 <hr>
1160 <a name="NOP"></a>
1161 <div class="header">
1162 <p>
1163 Next: <a href="#OPEN" accesskey="n" rel="next">OPEN</a>, Previous: <a href="#MOVE" accesskey="p" rel="previous">MOVE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1164 </div>
1165 <a name="NOP-command"></a>
1166 <h2 class="chapter">25 NOP command</h2>
1167 <a name="index-NOP-command"></a>
1168 <p>Syntax:
1169 </p><div class="example">
1170 <pre class="example">NOP
1171 </pre></div>
1172
1173 <p>Does nothing. Always returns successfully.
1174 </p>
1175
1176 <hr>
1177 <a name="OPEN"></a>
1178 <div class="header">
1179 <p>
1180 Next: <a href="#OPTION" accesskey="n" rel="next">OPTION</a>, Previous: <a href="#NOP" accesskey="p" rel="previous">NOP</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1181 </div>
1182 <a name="OPEN-command"></a>
1183 <h2 class="chapter">26 OPEN command</h2>
1184 <a name="index-OPEN-command"></a>
1185 <p>Syntax:
1186 </p><div class="example">
1187 <pre class="example">OPEN [--lock] &lt;filename&gt; [&lt;passphrase&gt;]
1188 </pre></div>
1189
1190 <p>Opens <var>filename</var> using <var>passphrase</var>. When the filename is not
1191 found on the file-system  then a new document will be created. If the file
1192 is found, it is looked for in the file cache. If cached and no
1193 <var>passphrase</var> was specified then the cached document is opened. When not
1194 cached, <cite>pinentry(1)</cite> will be used to retrieve the passphrase to use
1195 for decryption unless <samp>disable-pinentry</samp> (see <a href="#OPTION">OPTION</a>) was
1196 specified.
1197 </p>
1198 <p>When the <samp>--lock</samp> option is passed then the file mutex will be
1199 locked as if the <code>LOCK</code> command (see <a href="#LOCK">LOCK</a>) had been sent after the
1200 file has been opened.
1201 </p>
1202
1203 <hr>
1204 <a name="OPTION"></a>
1205 <div class="header">
1206 <p>
1207 Next: <a href="#PASSWD" accesskey="n" rel="next">PASSWD</a>, Previous: <a href="#OPEN" accesskey="p" rel="previous">OPEN</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1208 </div>
1209 <a name="OPTION-command"></a>
1210 <h2 class="chapter">27 OPTION command</h2>
1211 <a name="index-OPTION-command"></a>
1212 <p>Syntax:
1213 </p><div class="example">
1214 <pre class="example">OPTION &lt;NAME&gt;=&lt;VALUE&gt;
1215 </pre></div>
1216
1217 <p>Sets a client option <var>name</var> to <var>value</var>. The value for an option is
1218 kept for the duration of the connection.
1219 </p>
1220 <dl compact="compact">
1221 <dt>DISABLE-PINENTRY</dt>
1222 <dd><p>Disable use of <code>pinentry</code> for passphrase retrieval. When set, a
1223 server inquire is sent to the client to obtain the passphrase. This option
1224 may be set as needed before the see <a href="#OPEN">OPEN</a>, see <a href="#PASSWD">PASSWD</a>, and
1225 see <a href="#SAVE">SAVE</a> commands.
1226 </p>
1227 </dd>
1228 <dt>PINENTRY-TIMEOUT</dt>
1229 <dd><p>Sets the number of seconds before a pinentry prompt will return an error
1230 while waiting for user input.
1231 </p>
1232 </dd>
1233 <dt>TTYNAME</dt>
1234 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1235 </p>
1236 </dd>
1237 <dt>TTYTYPE</dt>
1238 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1239 </p>
1240 </dd>
1241 <dt>DISPLAY</dt>
1242 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1243 </p>
1244 </dd>
1245 <dt>PINENTRY-DESC</dt>
1246 <dd><p>Sets the description string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1247 </p>
1248 </dd>
1249 <dt>PINENTRY-TITLE</dt>
1250 <dd><p>Sets the title string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1251 </p>
1252 </dd>
1253 <dt>PINENTRY-PROMPT</dt>
1254 <dd><p>Sets the prompt string of the <code>gpg-agent</code> and <code>pinentry</code> dialog.
1255 </p>
1256 </dd>
1257 <dt>LC-CTYPE</dt>
1258 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1259 </p>
1260 </dd>
1261 <dt>LC-MESSAGES</dt>
1262 <dd><p>Passed to the <code>gpg-agent</code> and used for the <code>pinentry</code> dialog.
1263 </p>
1264 </dd>
1265 <dt>NAME</dt>
1266 <dd><p>Associates the thread ID of the connection with the specified textual
1267 representation. Useful for debugging log messages.
1268 </p>
1269 </dd>
1270 <dt>LOCK-TIMEOUT</dt>
1271 <dd><p>When not <code>0</code>, the duration in tenths of a second to wait for the file
1272 mutex which has been locked by another thread to be released before returning
1273 an error. When <code>-1</code>, then an error will be returned immediately.
1274 </p>
1275 </dd>
1276 <dt>LOG-LEVEL</dt>
1277 <dd><p>An integer specifiying the logging level.
1278 </p></dd>
1279 </dl>
1280
1281
1282 <hr>
1283 <a name="PASSWD"></a>
1284 <div class="header">
1285 <p>
1286 Next: <a href="#REALPATH" accesskey="n" rel="next">REALPATH</a>, Previous: <a href="#OPTION" accesskey="p" rel="previous">OPTION</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1287 </div>
1288 <a name="PASSWD-command"></a>
1289 <h2 class="chapter">28 PASSWD command</h2>
1290 <a name="index-PASSWD-command"></a>
1291 <p>Syntax:
1292 </p><div class="example">
1293 <pre class="example">PASSWD [--reset] [--s2k-count=N] [--no-passphrase]
1294 </pre></div>
1295
1296 <p>Changes the passphrase of the secret key required to open the current
1297 file or the passphrase of a symmetrically encrypted data file. When the
1298 <samp>--reset</samp> option is passed then the cache entry for the current
1299 file will be reset and the passphrase, if any, will be required during the
1300 next <code>OPEN</code>. See <a href="#OPEN">OPEN</a>.
1301 </p>
1302 <p>The <samp>--s2k-count</samp> option sets number of hash iterations for a
1303 passphrase and must be either <code>0</code> to use the calibrated count of the
1304 machine (the default), or a value greater than or equal to <code>65536</code>.
1305 See <a href="#SAVE">SAVE</a>. This option has no effect for symmetrically encrypted data
1306 files.
1307 </p>
1308 <p>The <samp>--no-passphrase</samp> option will prevent requiring a passphrase for
1309 the data file, although a passphrase may be required when changing it.
1310 </p>
1311
1312 <hr>
1313 <a name="REALPATH"></a>
1314 <div class="header">
1315 <p>
1316 Next: <a href="#RENAME" accesskey="n" rel="next">RENAME</a>, Previous: <a href="#PASSWD" accesskey="p" rel="previous">PASSWD</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1317 </div>
1318 <a name="REALPATH-command"></a>
1319 <h2 class="chapter">29 REALPATH command</h2>
1320 <a name="index-REALPATH-command"></a>
1321 <p>Syntax:
1322 </p><div class="example">
1323 <pre class="example">REALPATH [--inquire] [!]element[&lt;TAB&gt;[!]child[..]]
1324 </pre></div>
1325
1326 <p>Resolves all <code>target</code> attributes of the specified element path and
1327 returns the result with a data response. See <a href="#Target-Attribute">Target Attribute</a>, for details.
1328 </p>
1329 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1330 arguments are retrieved via a server <em>INQUIRE</em>.
1331 </p>
1332
1333 <hr>
1334 <a name="RENAME"></a>
1335 <div class="header">
1336 <p>
1337 Next: <a href="#RESET" accesskey="n" rel="next">RESET</a>, Previous: <a href="#REALPATH" accesskey="p" rel="previous">REALPATH</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1338 </div>
1339 <a name="RENAME-command"></a>
1340 <h2 class="chapter">30 RENAME command</h2>
1341 <a name="index-RENAME-command"></a>
1342 <p>Syntax:
1343 </p><div class="example">
1344 <pre class="example">RENAME [--inquire] [!]element[&lt;TAB&gt;[!]child[..]] &lt;value&gt;
1345 </pre></div>
1346
1347 <p>Renames the specified <var>element</var> to the new <var>value</var>. If an element of
1348 the same name as the <var>value</var> already exists it will be overwritten.
1349 </p>
1350 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1351 arguments are retrieved via a server <em>INQUIRE</em>.
1352 </p>
1353
1354 <hr>
1355 <a name="RESET"></a>
1356 <div class="header">
1357 <p>
1358 Next: <a href="#SAVE" accesskey="n" rel="next">SAVE</a>, Previous: <a href="#RENAME" accesskey="p" rel="previous">RENAME</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1359 </div>
1360 <a name="RESET-command"></a>
1361 <h2 class="chapter">31 RESET command</h2>
1362 <a name="index-RESET-command"></a>
1363 <p>Syntax:
1364 </p><div class="example">
1365 <pre class="example">RESET
1366 </pre></div>
1367
1368 <p>Closes the currently opened file but keeps any previously set client options.
1369 </p>
1370
1371 <hr>
1372 <a name="SAVE"></a>
1373 <div class="header">
1374 <p>
1375 Next: <a href="#STORE" accesskey="n" rel="next">STORE</a>, Previous: <a href="#RESET" accesskey="p" rel="previous">RESET</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1376 </div>
1377 <a name="SAVE-command"></a>
1378 <h2 class="chapter">32 SAVE command</h2>
1379 <a name="index-SAVE-command"></a>
1380 <p>Syntax:
1381 </p><div class="example">
1382 <pre class="example">SAVE [--no-passphrase] [--reset] [--no-agent] [--s2k-count=N] [--cipher=&lt;algo&gt;] [--cipher-iterations=N] [--inquire-keyparam] [--keygrip=hexstring] [--sign-keygrip=hexstring]
1383 </pre></div>
1384
1385 <p>Writes the <abbr>XML</abbr> document to disk. The file written to is the file that
1386 was opened using the <code>OPEN</code> command (see <a href="#OPEN">OPEN</a>). If the file is a
1387 new one or the option <samp>--inquire-keyparam</samp> was passed, then a new
1388 keypair will be generated and a pinentry will be used to prompt for the
1389 passphrase to encrypt with unless the <samp>--no-passphrase</samp> option was
1390 passed in which case the data file will not be passphrase protected.
1391 </p>
1392 <p>The <samp>--no-agent</samp> option disables use of <code>gpg-agent</code> for
1393 passphrase retrieval and caching of new files when <code>gpg-agent</code>
1394 use is enabled. The datafile will be symmetrically encrypted and will not
1395 use or generate any keypair.
1396 </p>
1397 <p>The <samp>--reset</samp> option will clear the cache entry for the current file
1398 and require a passphrase, if needed, before saving.
1399 </p>
1400 <p>The <samp>--cipher</samp> option can be used to encrypt the <abbr>XML</abbr> data to
1401 an alternate cipher. The default is <code>aes256</code>. See the Configuration
1402 (see <a href="#Configuration">Configuration</a>) for available ciphers.
1403 </p>
1404 <p>The <samp>--cipher-iterations</samp> option  specifies the number of times to
1405 encrypt the XML data. The default is 0 although 1 iteration is still done.
1406 </p>
1407 <p>The <samp>--inquire-keyparam</samp> option will send a server <em>INQUIRE</em> to
1408 the client to obtain the key paramaters to use when generating a new
1409 keypair. The inquired data is expected to be an S-expression. If not
1410 specified then an &lsquo;<samp>RSA</samp>&rsquo; key of &lsquo;<samp>2048</samp>&rsquo; bits will be generated
1411 unless otherwise set in the configuration file (see <a href="#Configuration">Configuration</a>). Note
1412 that when this option is specified a new keypair will be generated
1413 reguardless if the file is a new one and that if the data file is protected
1414 the passphrase to open it will be required before generating the new keypair.
1415 </p>
1416 <p>You can encrypt the data file to a public key other than the one that it
1417 was originally encrypted with by passing the <samp>--keygrip</samp> option with
1418 the hex encoded keygrip of the public key as its argument. The keygrip may
1419 be of any key that <code>gpg-agent</code> knows about. The
1420 <samp>--sign-keygrip</samp> option may also be used to sign with an alternate
1421 secret key. This option may be needed when using a smartcard. This option
1422 has no effect with symmetrically encrypted data files.
1423 </p>
1424 <p>The <samp>--s2k-count</samp> option sets number of hash iterations for a
1425 passphrase. A value less-than <code>65536</code> will use the machine calibrated
1426 value and is the default. This setting only affects new files. To change
1427 the setting use the <code>PASSWD</code> command (see <a href="#PASSWD">PASSWD</a>). This option
1428 has no effect with symmetrically encrypted data files.
1429 </p>
1430
1431 <hr>
1432 <a name="STORE"></a>
1433 <div class="header">
1434 <p>
1435 Next: <a href="#UNLOCK" accesskey="n" rel="next">UNLOCK</a>, Previous: <a href="#SAVE" accesskey="p" rel="previous">SAVE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1436 </div>
1437 <a name="STORE-command"></a>
1438 <h2 class="chapter">33 STORE command</h2>
1439 <a name="index-STORE-command"></a>
1440 <p>Syntax:
1441 </p><div class="example">
1442 <pre class="example">STORE [!]element[&lt;TAB&gt;[!]child[..]]&lt;TAB&gt;[content]
1443 </pre></div>
1444
1445 <p>This command uses a server <em>INQUIRE</em> to retrieve data from the client.
1446 </p>
1447 <p>Creates a new element path or modifies the <var>content</var> of an existing
1448 element. If only a single element is specified then a new root element is
1449 created. Otherwise, elements are <tt class="key">TAB</tt> delimited and the content will be
1450 set to the final <tt class="key">TAB</tt> delimited element. If no <var>content</var> is
1451 specified after the final <tt class="key">TAB</tt>, then the content of the element will
1452 be removed, or empty when creating a new element.
1453 </p>
1454 <p>The only restriction of an element name is that it not contain whitespace
1455 or begin with the literal element character <code>!</code> unless specifying a
1456 literal element (see <a href="#Target-Attribute">Target Attribute</a>). There is no whitespace between
1457 the <tt class="key">TAB</tt> delimited elements. It is recommended that the content of an
1458 element be base64 encoded when it contains control or <tt class="key">TAB</tt> characters
1459 to prevent <abbr>XML</abbr> parsing and <code>pwmd</code> syntax errors.
1460 </p>
1461
1462 <hr>
1463 <a name="UNLOCK"></a>
1464 <div class="header">
1465 <p>
1466 Next: <a href="#XPATH" accesskey="n" rel="next">XPATH</a>, Previous: <a href="#STORE" accesskey="p" rel="previous">STORE</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1467 </div>
1468 <a name="UNLOCK-command"></a>
1469 <h2 class="chapter">34 UNLOCK command</h2>
1470 <a name="index-UNLOCK-command"></a>
1471 <p>Syntax:
1472 </p><div class="example">
1473 <pre class="example">UNLOCK
1474 </pre></div>
1475
1476 <p>Unlocks the file mutex which was locked with the <code>LOCK</code> command or
1477 a commands&rsquo; <samp>--lock</samp> option (see <a href="#LOCK">LOCK</a>, see <a href="#OPEN">OPEN</a>,
1478 see <a href="#ISCACHED">ISCACHED</a>).
1479 </p>
1480
1481 <hr>
1482 <a name="XPATH"></a>
1483 <div class="header">
1484 <p>
1485 Next: <a href="#XPATHATTR" accesskey="n" rel="next">XPATHATTR</a>, Previous: <a href="#UNLOCK" accesskey="p" rel="previous">UNLOCK</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1486 </div>
1487 <a name="XPATH-command"></a>
1488 <h2 class="chapter">35 XPATH command</h2>
1489 <a name="index-XPATH-command"></a>
1490 <p>Syntax:
1491 </p><div class="example">
1492 <pre class="example">XPATH [--inquire] &lt;expression&gt;[&lt;TAB&gt;[value]]
1493 </pre></div>
1494
1495 <p>Evaluates an XPath <var>expression</var>. If no <var>value</var> argument is
1496 specified it is assumed the expression is a request to return a result.
1497 Otherwise, the result is set to the <var>value</var> argument and the document is
1498 updated. If there is no <var>value</var> after the <tt class="key">TAB</tt> character, the value
1499 is assumed to be empty and the document is updated. For example:
1500 </p><br>
1501 <div class="example">
1502 <pre class="example">XPATH //element[@_name='password']<span class="key">TAB</span>
1503 </pre></div>
1504 <br>
1505 <p>would clear the content of all <code>password</code> elements in the data file
1506 while leaving off the trailing <tt class="key">TAB</tt> would return all <code>password</code>
1507 elements in <abbr>XML</abbr> format.
1508 </p>
1509 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1510 arguments are retrieved via a server <em>INQUIRE</em>.
1511 </p>
1512 <p>See <a href="http://www.w3schools.com/xpath/xpath_syntax.asp">http://www.w3schools.com/xpath/xpath_syntax.asp</a> for <abbr>XPATH</abbr>
1513 expression syntax.
1514 </p>
1515
1516 <hr>
1517 <a name="XPATHATTR"></a>
1518 <div class="header">
1519 <p>
1520 Previous: <a href="#XPATH" accesskey="p" rel="previous">XPATH</a>, Up: <a href="#Commands" accesskey="u" rel="up">Commands</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1521 </div>
1522 <a name="XPATHATTR-command"></a>
1523 <h2 class="chapter">36 XPATHATTR command</h2>
1524 <a name="index-XPATHATTR-command"></a>
1525 <p>Syntax:
1526 </p><div class="example">
1527 <pre class="example">XPATHATTR [--inquire] SET|DELETE &lt;name&gt; &lt;expression&gt;[&lt;TAB&gt;[&lt;value&gt;]]
1528 </pre></div>
1529
1530 <p>Like the <code>XPATH</code> command (see <a href="#XPATH">XPATH</a>) but operates on element
1531 attributes and does not return a result. For the <var>SET</var> operation the
1532 <var>value</var> is optional but the field is required. If not specified then
1533 the attribute value will be empty. For example:
1534 </p><br>
1535 <div class="example">
1536 <pre class="example">XPATHATTR SET password //element[@_name='password']<span class="key">TAB</span>
1537 </pre></div>
1538 <br>
1539 <p>would create an <code>password</code> attribute for each <code>password</code> element
1540 found in the document. The attribute value will be empty but still exist.
1541 </p>
1542 <p>When the <samp>--inquire</samp> option is passed then all remaining non-option
1543 arguments are retrieved via a server <em>INQUIRE</em>.
1544 </p>
1545 <p>See <a href="http://www.w3schools.com/xpath/xpath_syntax.asp">http://www.w3schools.com/xpath/xpath_syntax.asp</a> for <abbr>XPATH</abbr>
1546 expression syntax.
1547 </p>
1548
1549
1550 <hr>
1551 <a name="Status-Messages"></a>
1552 <div class="header">
1553 <p>
1554 Next: <a href="#Target-Attribute" accesskey="n" rel="next">Target Attribute</a>, Previous: <a href="#Commands" accesskey="p" rel="previous">Commands</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1555 </div>
1556 <a name="Status-messages-and-their-meanings"></a>
1557 <h2 class="chapter">37 Status messages and their meanings</h2>
1558 <p>Some commands send status messages to inform the client about certain
1559 operations or as a progress indicator.  Status messages begin with a
1560 <code>KEYWORD</code> followed by a status description for status messages that
1561 require it. What status messages are sent, when, and how often depend on
1562 configuration settings (see <a href="#Configuration">Configuration</a>). A status message sent from
1563 <code>gpg-agent</code> (See <a href="http://www.gnupg.org/documentation/manuals/gnupg/Invoking-GPG_002dAGENT.html#Invoking-GPG_002dAGENT">(gnupg)Invoking GPG-AGENT</a>) is also forwarded to
1564 the client.
1565 </p>
1566 <table>
1567 <thead><tr><th width="20%">Message</th><th width="25%">Arguments</th><th width="55%">Description</th></tr></thead>
1568 <tr><td width="20%">CACHE
1569 <a name="index-CACHE"></a></td><td width="25%"><code>&lt;integer&gt;</code></td><td width="55%">The number of cached documents. Sent to each client after connecting
1570 (see <a href="#GETINFO">GETINFO</a>) and after every cache modification.</td></tr>
1571 <tr><td width="20%">CLIENTS
1572 <a name="index-CLIENTS"></a></td><td width="25%"><code>&lt;integer&gt;</code></td><td width="55%">The number of connected clients (see <a href="#GETINFO">GETINFO</a>). Sent to each client
1573 when another client either connects or disconnects.</td></tr>
1574 <tr><td width="20%">DECRYPT
1575 <a name="index-DECRYPT"></a></td><td width="25%"><code>n</code> <code>total</code></td><td width="55%">Sent to the current client during a decrypt operation. How often this
1576 status message is sent is determined by the <code>cipher_progress</code>
1577 (see <a href="#Configuration">Configuration</a>) setting.</td></tr>
1578 <tr><td width="20%">ENCRYPT
1579 <a name="index-ENCRYPT"></a></td><td width="25%"><code>n</code> <code>total</code></td><td width="55%">Sent to the current client during an  encrypt operation. How often this
1580 status message is sent is determined by the <code>cipher_progress</code>
1581 (see <a href="#Configuration">Configuration</a>) setting.</td></tr>
1582 <tr><td width="20%">GENKEY
1583 <a name="index-GENKEY"></a></td><td width="25%"></td><td width="55%">Sent once to the current client just before generating a new key-pair.</td></tr>
1584 <tr><td width="20%">INQUIRE_MAXLEN
1585 <a name="index-INQUIRE_005fMAXLEN"></a></td><td width="25%"><code>&lt;bytes&gt;</code></td><td width="55%">Sent to the client from <code>gpg-agent</code> when inquiring data. This
1586 specifies the maximum number of bytes allowed for the client to send and
1587 should not be exceeded.</td></tr>
1588 <tr><td width="20%">KEEPALIVE
1589 <a name="index-KEEPALIVE"></a></td><td width="25%"></td><td width="55%">Sent to each idle client every <var>keepalive_interval</var>
1590 (see <a href="#Configuration">Configuration</a>) seconds.</td></tr>
1591 <tr><td width="20%">LOCKED
1592 <a name="index-LOCKED"></a></td><td width="25%"></td><td width="55%">Sent to the current client when another client is holding the lock for
1593 the mutex associated with a file.</td></tr>
1594 <tr><td width="20%">NEWFILE
1595 <a name="index-NEWFILE"></a></td><td width="25%"></td><td width="55%">Sent to the current client when the opened (see <a href="#OPEN">OPEN</a>) file does not
1596 exist on the file-system.</td></tr>
1597 <tr><td width="20%">XFER
1598 <a name="index-XFER"></a></td><td width="25%"><code>&lt;sent&gt; &lt;total&gt;</code></td><td width="55%">Sent to the current client when transferring data. It has two space
1599 delimited arguments. The first being the current amount of bytes transferred
1600 and the other being the total bytes to be transferred.</td></tr>
1601 </table>
1602
1603 <hr>
1604 <a name="Target-Attribute"></a>
1605 <div class="header">
1606 <p>
1607 Next: <a href="#Signals" accesskey="n" rel="next">Signals</a>, Previous: <a href="#Status-Messages" accesskey="p" rel="previous">Status Messages</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1608 </div>
1609 <a name="The-target-attribute"></a>
1610 <h2 class="chapter">38 The <code>target</code> attribute</h2>
1611 <a name="index-target-attribute"></a>
1612 <p>A <em>case sensitive</em> attribute named <code>target</code> is treated specially
1613 when found in each element of an element path. This attribute, like other
1614 element attributes, is created or modified with the <code>ATTR</code> command
1615 (see <a href="#ATTR">ATTR</a>). The value of this attribute is an existing element path
1616 somewhere in the document.  If you are familiar with <abbr>XML</abbr> entities or
1617 maybe the <abbr>HTML</abbr> <code>id</code> or <code>target</code> attributes or a symbolic link
1618 in a file-system, you may find this attribute behaves similar to any of those.
1619 </p>
1620 <p>To create a <code>target</code> attribute use the following syntax:
1621 </p>
1622 <div class="example">
1623 <pre class="example">ATTR SET target [!]element[<span class="key">TAB</span>[!]child[..]] [!]element[<span class="key">TAB</span>[!]child[..]]
1624 </pre></div>
1625
1626 <p>Note the single space between the two element paths. The first element path is
1627 where the <code>target</code> attribute will be created. If the element path does
1628 not exist then it will be created.  This is the only time the <code>ATTR</code>
1629 (see <a href="#ATTR">ATTR</a>) command will create elements. The attribute is created in the
1630 final element of the element path.
1631 </p>
1632 <p>The second element path is the destination of where you want the first element
1633 path to resolve to. When an element path is passed to a protocol command
1634 <code>pwmd</code> looks for a <code>target</code> attribute when resolving each element
1635 and if found, &quot;jumps&quot; to the attribute value and continues resolving any
1636 remaining elements.  When you want to avoid the <code>target</code> attribute for
1637 any element of an element path then prefix the element with the literal
1638 element character &lsquo;<samp>!</samp>&rsquo;.
1639 </p>
1640 <p>When an element of a element path is removed that a <code>target</code> attribute
1641 resolves to then an error will occur. You may need to either update the
1642 <code>target</code> attribute value with a new element path or remove the attribute
1643 entirely. Remember that since the element contains the <code>target</code> attribute
1644 it will need to be prefixed with the literal element character &lsquo;<samp>!</samp>&rsquo; when
1645 specifying the element path. For example, to remove a <code>target</code>
1646 attribute for an element containing it:
1647 </p>
1648 <div class="example">
1649 <pre class="example">ATTR DELETE target path<span class="key">TAB</span>to<span class="key">TAB</span>!element
1650 </pre></div>
1651
1652 <p>Clients should be careful of creating <code>target</code> loops, or targets that
1653 resolve to themselves. See the <var>recursion_depth</var> (see <a href="#Configuration">Configuration</a>)
1654 configuration parameter for details.
1655 </p>
1656 <p>The <code>REALPATH</code> command (see <a href="#REALPATH">REALPATH</a>) can be used to show the element
1657 path after resolving all <code>target</code> attributes.
1658 </p>
1659
1660 <hr>
1661 <a name="Signals"></a>
1662 <div class="header">
1663 <p>
1664 Next: <a href="#Concept-Index" accesskey="n" rel="next">Concept Index</a>, Previous: <a href="#Target-Attribute" accesskey="p" rel="previous">Target Attribute</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1665 </div>
1666 <a name="Recognized-signals"></a>
1667 <h2 class="chapter">39 Recognized signals</h2>
1668
1669 <p>Sending the <em>SIGHUP</em> signal to a <code>pwmd</code> process will reload the
1670 configuration file and sending <em>SIGUSR1</em> will clear the entire file
1671 cache.
1672 </p>
1673
1674
1675 <hr>
1676 <a name="Concept-Index"></a>
1677 <div class="header">
1678 <p>
1679 Previous: <a href="#Signals" accesskey="p" rel="previous">Signals</a>, Up: <a href="#Top" accesskey="u" rel="up">Top</a> &nbsp; [<a href="#SEC_Contents" title="Table of contents" rel="contents">Contents</a>]</p>
1680 </div>
1681 <a name="Concept-Index-1"></a>
1682 <h2 class="unnumbered">Concept Index</h2>
1683
1684
1685 <a name="SEC_Overview"></a>
1686 <h2 class="shortcontents-heading">Short Table of Contents</h2>
1687
1688 <div class="shortcontents">
1689 <ul class="no-bullet">
1690 <li><a name="stoc-Overview-of-pwmd" href="#toc-Overview-of-pwmd">1 Overview of <code>pwmd</code></a></li>
1691 <li><a name="stoc-Invoking-pwmd" href="#toc-Invoking-pwmd">2 Invoking <code>pwmd</code></a></li>
1692 <li><a name="stoc-pwmd-configuration-file-options" href="#toc-pwmd-configuration-file-options">3 <code>pwmd</code> configuration file options</a></li>
1693 <li><a name="stoc-Configuring-remote-connections-over-TLS_002e" href="#toc-Configuring-remote-connections-over-TLS_002e">4 Configuring remote connections over TLS.</a></li>
1694 <li><a name="stoc-Pinentry-configuration" href="#toc-Pinentry-configuration">5 Pinentry configuration</a></li>
1695 <li><a name="stoc-Protocol-commands-and-their-syntax" href="#toc-Protocol-commands-and-their-syntax">6 Protocol commands and their syntax</a></li>
1696 <li><a name="stoc-AGENT-command" href="#toc-AGENT-command">7 AGENT command</a></li>
1697 <li><a name="stoc-ATTR-command" href="#toc-ATTR-command">8 ATTR command</a></li>
1698 <li><a name="stoc-CACHETIMEOUT-command" href="#toc-CACHETIMEOUT-command">9 CACHETIMEOUT command</a></li>
1699 <li><a name="stoc-CLEARCACHE-command" href="#toc-CLEARCACHE-command">10 CLEARCACHE command</a></li>
1700 <li><a name="stoc-COPY-command" href="#toc-COPY-command">11 COPY command</a></li>
1701 <li><a name="stoc-DELETE-command" href="#toc-DELETE-command">12 DELETE command</a></li>
1702 <li><a name="stoc-DUMP-command" href="#toc-DUMP-command">13 DUMP command</a></li>
1703 <li><a name="stoc-GET-command" href="#toc-GET-command">14 GET command</a></li>
1704 <li><a name="stoc-GETCONFIG-command" href="#toc-GETCONFIG-command">15 GETCONFIG command</a></li>
1705 <li><a name="stoc-GETINFO-command" href="#toc-GETINFO-command">16 GETINFO command</a></li>
1706 <li><a name="stoc-HELP-command" href="#toc-HELP-command">17 HELP command</a></li>
1707 <li><a name="stoc-IMPORT-command" href="#toc-IMPORT-command">18 IMPORT command</a></li>
1708 <li><a name="stoc-ISCACHED-command" href="#toc-ISCACHED-command">19 ISCACHED command</a></li>
1709 <li><a name="stoc-KEYGRIP-command" href="#toc-KEYGRIP-command">20 KEYGRIP command</a></li>
1710 <li><a name="stoc-LIST-command" href="#toc-LIST-command">21 LIST command</a></li>
1711 <li><a name="stoc-LOCK-command" href="#toc-LOCK-command">22 LOCK command</a></li>
1712 <li><a name="stoc-LS-command" href="#toc-LS-command">23 LS command</a></li>
1713 <li><a name="stoc-MOVE-command" href="#toc-MOVE-command">24 MOVE command</a></li>
1714 <li><a name="stoc-NOP-command" href="#toc-NOP-command">25 NOP command</a></li>
1715 <li><a name="stoc-OPEN-command" href="#toc-OPEN-command">26 OPEN command</a></li>
1716 <li><a name="stoc-OPTION-command" href="#toc-OPTION-command">27 OPTION command</a></li>
1717 <li><a name="stoc-PASSWD-command" href="#toc-PASSWD-command">28 PASSWD command</a></li>
1718 <li><a name="stoc-REALPATH-command" href="#toc-REALPATH-command">29 REALPATH command</a></li>
1719 <li><a name="stoc-RENAME-command" href="#toc-RENAME-command">30 RENAME command</a></li>
1720 <li><a name="stoc-RESET-command" href="#toc-RESET-command">31 RESET command</a></li>
1721 <li><a name="stoc-SAVE-command" href="#toc-SAVE-command">32 SAVE command</a></li>
1722 <li><a name="stoc-STORE-command" href="#toc-STORE-command">33 STORE command</a></li>
1723 <li><a name="stoc-UNLOCK-command" href="#toc-UNLOCK-command">34 UNLOCK command</a></li>
1724 <li><a name="stoc-XPATH-command" href="#toc-XPATH-command">35 XPATH command</a></li>
1725 <li><a name="stoc-XPATHATTR-command" href="#toc-XPATHATTR-command">36 XPATHATTR command</a></li>
1726 <li><a name="stoc-Status-messages-and-their-meanings" href="#toc-Status-messages-and-their-meanings">37 Status messages and their meanings</a></li>
1727 <li><a name="stoc-The-target-attribute" href="#toc-The-target-attribute">38 The <code>target</code> attribute</a></li>
1728 <li><a name="stoc-Recognized-signals" href="#toc-Recognized-signals">39 Recognized signals</a></li>
1729 <li><a name="stoc-Concept-Index-1" href="#toc-Concept-Index-1">Concept Index</a></li>
1730
1731 </ul>
1732 </div>
1733
1734 <a name="SEC_Contents"></a>
1735 <h2 class="contents-heading">Table of Contents</h2>
1736
1737 <div class="contents">
1738 <ul class="no-bullet">
1739 <li><a name="toc-Overview-of-pwmd" href="#Introduction">1 Overview of <code>pwmd</code></a></li>
1740 <li><a name="toc-Invoking-pwmd" href="#Invoking">2 Invoking <code>pwmd</code></a></li>
1741 <li><a name="toc-pwmd-configuration-file-options" href="#Configuration">3 <code>pwmd</code> configuration file options</a></li>
1742 <li><a name="toc-Configuring-remote-connections-over-TLS_002e" href="#TLS">4 Configuring remote connections over TLS.</a></li>
1743 <li><a name="toc-Pinentry-configuration" href="#Pinentry">5 Pinentry configuration</a></li>
1744 <li><a name="toc-Protocol-commands-and-their-syntax" href="#Commands">6 Protocol commands and their syntax</a></li>
1745 <li><a name="toc-AGENT-command" href="#AGENT">7 AGENT command</a></li>
1746 <li><a name="toc-ATTR-command" href="#ATTR">8 ATTR command</a></li>
1747 <li><a name="toc-CACHETIMEOUT-command" href="#CACHETIMEOUT">9 CACHETIMEOUT command</a></li>
1748 <li><a name="toc-CLEARCACHE-command" href="#CLEARCACHE">10 CLEARCACHE command</a></li>
1749 <li><a name="toc-COPY-command" href="#COPY">11 COPY command</a></li>
1750 <li><a name="toc-DELETE-command" href="#DELETE">12 DELETE command</a></li>
1751 <li><a name="toc-DUMP-command" href="#DUMP">13 DUMP command</a></li>
1752 <li><a name="toc-GET-command" href="#GET">14 GET command</a></li>
1753 <li><a name="toc-GETCONFIG-command" href="#GETCONFIG">15 GETCONFIG command</a></li>
1754 <li><a name="toc-GETINFO-command" href="#GETINFO">16 GETINFO command</a></li>
1755 <li><a name="toc-HELP-command" href="#HELP">17 HELP command</a></li>
1756 <li><a name="toc-IMPORT-command" href="#IMPORT">18 IMPORT command</a></li>
1757 <li><a name="toc-ISCACHED-command" href="#ISCACHED">19 ISCACHED command</a></li>
1758 <li><a name="toc-KEYGRIP-command" href="#KEYGRIP">20 KEYGRIP command</a></li>
1759 <li><a name="toc-LIST-command" href="#LIST">21 LIST command</a></li>
1760 <li><a name="toc-LOCK-command" href="#LOCK">22 LOCK command</a></li>
1761 <li><a name="toc-LS-command" href="#LS">23 LS command</a></li>
1762 <li><a name="toc-MOVE-command" href="#MOVE">24 MOVE command</a></li>
1763 <li><a name="toc-NOP-command" href="#NOP">25 NOP command</a></li>
1764 <li><a name="toc-OPEN-command" href="#OPEN">26 OPEN command</a></li>
1765 <li><a name="toc-OPTION-command" href="#OPTION">27 OPTION command</a></li>
1766 <li><a name="toc-PASSWD-command" href="#PASSWD">28 PASSWD command</a></li>
1767 <li><a name="toc-REALPATH-command" href="#REALPATH">29 REALPATH command</a></li>
1768 <li><a name="toc-RENAME-command" href="#RENAME">30 RENAME command</a></li>
1769 <li><a name="toc-RESET-command" href="#RESET">31 RESET command</a></li>
1770 <li><a name="toc-SAVE-command" href="#SAVE">32 SAVE command</a></li>
1771 <li><a name="toc-STORE-command" href="#STORE">33 STORE command</a></li>
1772 <li><a name="toc-UNLOCK-command" href="#UNLOCK">34 UNLOCK command</a></li>
1773 <li><a name="toc-XPATH-command" href="#XPATH">35 XPATH command</a></li>
1774 <li><a name="toc-XPATHATTR-command" href="#XPATHATTR">36 XPATHATTR command</a></li>
1775 <li><a name="toc-Status-messages-and-their-meanings" href="#Status-Messages">37 Status messages and their meanings</a></li>
1776 <li><a name="toc-The-target-attribute" href="#Target-Attribute">38 The <code>target</code> attribute</a></li>
1777 <li><a name="toc-Recognized-signals" href="#Signals">39 Recognized signals</a></li>
1778 <li><a name="toc-Concept-Index-1" href="#Concept-Index">Concept Index</a></li>
1779
1780 </ul>
1781 </div>
1782
1783 <hr>
1784
1785
1786
1787 </body>
1788 </html>