# CommandSection

title: PARAMETERS
content:
<b><b>debug</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Enables debug messages to be written to syslog.</i><br><br><b><b>nodate</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Suppresses the display of the last login date.</i><br><br><b><b>nohost</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Suppresses the display of the last login hostname.</i><br><br><b><b>notty</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Suppresses the display of the last login terminal (TTY).</i><br><br><b><b>never</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Causes 'Never logged in' to be printed if the user has no previous login record.</i><br><br><b><b>silent</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Suppresses all output related to the last login information. The module will still update the record if configured to do so.</i><br><br><b><b>update</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Forces the update of the lastlog record for the user, even if the module is in an 'auth' stack that might otherwise skip updates.</i><br><br><b><b>noupdate</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Prevents the module from updating the lastlog record. It will still display information if not 'silent'.</i><br><br><b><b>lastlog=/path/to/lastlog</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Specifies an alternative path for the lastlog file instead of the default <b>/var/log/lastlog</b>.</i><br><br><b><b>lastlog_dir=/path/to/dir</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Specifies an alternative directory where the lastlog file can be created if it's a sparse file. Less commonly used.</i><br><br><b><b>unlimited</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Do not truncate the displayed last login string to the screen width.</i><br><br><b><b>nouser</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Do not print 'Unknown user' for users who do not exist in the system's password database.</i><br><br><b><b>delay=SECONDS</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Introduces a delay (in seconds) before displaying the last login information. Useful in scenarios like telnet to ensure the client has time to receive data.</i><br><br>


title: DESCRIPTION
content:
The <b>pam_lastlog</b> module is a Pluggable Authentication Module (PAM) responsible for recording and optionally displaying the last login time, date, host, and terminal for a user. It primarily interacts with the <b>/var/log/lastlog</b> file, which stores this information efficiently using a sparse file format.<br><br>Upon a successful user authentication, <b>pam_lastlog</b> updates the user's entry in the <b>lastlog</b> file. During the session setup phase, it can be configured to display this last login information to the user. This module is an essential component for system security and auditing, providing administrators and users with a record of login activity.<br><br>It's crucial to understand that <b>pam_lastlog</b> is not a standalone command executed directly from the shell like <b>ls</b> or <b>grep</b>. Instead, it is a shared library module (<b>pam_lastlog.so</b>) that is invoked by PAM-aware applications (e.g., <b>login</b>, <b>sshd</b>) based on configurations in files located in <b>/etc/pam.d/</b>. Its behavior is controlled by options specified alongside the module name in these PAM configuration files.


title: CAVEATS
content:
<b>pam_lastlog</b> relies on the <b>/var/log/lastlog</b> file being writable by the process performing the login. If the file is inaccessible or permissions are incorrect, the last login record may not be updated, or information may not be displayed correctly. Since it's a PAM module, its behavior is entirely dependent on its placement and options within the system's PAM configuration files. Improper configuration can lead to unexpected behavior or security issues.


title: PAM CONFIGURATION PLACEMENT
content:
<b>pam_lastlog</b> is typically configured in the <b>session</b> and sometimes the <b>auth</b> stack of PAM-aware services. For instance, in <b>/etc/pam.d/login</b> or <b>/etc/pam.d/sshd</b>, you might find lines like:<br><i><pre>session    optional     pam_lastlog.so<br>auth       optional     pam_lastlog.so update</pre></i><br>The <b>session</b> entry is generally responsible for displaying the last login information, while the <b>auth</b> entry (often with the <b>update</b> option) ensures the <b>lastlog</b> file is updated upon successful authentication.


title: THE LASTLOG FILE
content:
The <b>/var/log/lastlog</b> file is a critical binary file that stores records for each user ID. It's a 'sparse file,' meaning it only consumes disk space for user IDs that have actually logged in, making it efficient for systems with a large range of possible UIDs but few actual users. Each entry typically contains the login time, terminal, and host. You can view its contents indirectly using commands like <b>last</b> or <b>lastlog</b> (utility).


title: HISTORY
content:
<b>pam_lastlog</b> is a core component of the Linux-PAM (Pluggable Authentication Modules) project, which was developed to provide a flexible and standardized authentication framework for Linux systems. It emerged as a replacement for older, monolithic authentication systems, allowing system administrators to easily configure authentication mechanisms without recompiling applications. <b>pam_lastlog</b> has been a standard module for tracking user login activity since the early days of PAM, contributing to system auditing and user awareness of their login history.


title: SEE ALSO
content:
<b>last(1)</b>, <b>w(1)</b>, <b>who(1)</b>, <b>lastb(1)</b>, <b>faillog(8)</b>, <b>pam(8)</b>, <b>pam.conf(5)</b>, <b>login(1)</b>, <b>sshd(8)</b>


title: SYNOPSIS
content:
This module is configured within PAM service files (e.g., <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>), typically as a <B>session</B> type module. Its basic usage is:<br><br><B>session required pam_limits.so [debug] [conf=</B><I>PATH</I><B>] [noaudit]</B>


title: PARAMETERS
content:
<b><B>debug</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints debugging information to syslog, which can be useful for troubleshooting limit application issues.<br><br><b><B>conf=</B><I>PATH</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative path to the limits configuration file, overriding the default <I>/etc/security/limits.conf</I> and files in <I>/etc/security/limits.d/</I>.<br><br><b><B>noaudit</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses audit messages generated by the module. By default, <I>pam_limits</I> may log audit messages about limit application.<br><br>


title: DESCRIPTION
content:
<I>pam_limits</I> is a <B>PAM (Pluggable Authentication Modules)</B> session module that applies resource limits for users during session establishment. These limits are defined in the <I>/etc/security/limits.conf</I> file and files within the <I>/etc/security/limits.d/</I> directory. It allows administrators to control various system resources, such as the maximum number of open files, CPU time, memory usage, number of processes, and more, for individual users or groups.<br><br>The module is typically configured in PAM service files (e.g., <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>) under the <B>session</B> stack. Upon a user's successful login, <I>pam_limits</I> reads the configured limits and applies them to the new session, enforcing resource management and preventing a single user or process from consuming excessive system resources.


title: CAVEATS
content:
<B>Configuration File Format</B>: The module relies heavily on the correct format of <I>/etc/security/limits.conf</I> and its included files. Incorrect entries can lead to unexpected behavior, ignored limits, or even failed logins if not handled carefully.<br><br><B>Order in PAM Stack</B>: For the module to function correctly, it must be placed in the <B>session</B> stack of PAM service files. Its position relative to other modules might be important; it's generally best to place it early in the session stack to ensure limits are applied before other session-specific setups.<br><br><B>Hard vs. Soft Limits</B>: <I>pam_limits</I> sets both soft and hard limits. Soft limits are the actual limits applied, which a user can increase (within their session) up to the hard limit. Hard limits are maximums that can only be increased by a privileged process (e.g., root). Users cannot set their soft limits higher than the hard limits.<br><br><B>Root User</B>: Limits for the root user are often `unlimited` by default or are intentionally ignored to prevent system instability. Applying strict limits to root can lead to unintended consequences.<br><br><B>No Dynamic Changes</B>: Limits are applied at session creation. Changes to <I>/etc/security/limits.conf</I> or its related files do not affect already running sessions; users must log out and log back in for new limits to take effect.


title: <B>CONFIGURATION FILE STRUCTURE</B>
content:
The primary configuration file for <I>pam_limits</I> is <I>/etc/security/limits.conf</I>, which can also include files from the <I>/etc/security/limits.d/</I> directory. Each significant line in these files typically follows the format:<br><br><I># &lt;domain&gt; &lt;type&gt; &lt;item&gt; &lt;value&gt;</I><br><br><ul><li><B>&lt;domain&gt;</B>: Specifies the user, group, or wildcard the limit applies to. Examples include a specific username (<I>john</I>), a group name prefixed with `@` (<I>@developers</I>), or a wildcard for all users/groups (<I>*</I>).</li><li><B>&lt;type&gt;</B>: Defines whether the limit is a <I>soft</I> (<B>soft</B>) limit, a <I>hard</I> (<B>hard</B>) limit, or applies to both (<B>-</B>).</li><li><B>&lt;item&gt;</B>: The specific resource to be limited (e.g., <I>nofile</I> for the maximum number of open files, <I>nproc</I> for the maximum number of processes, <I>cpu</I> for CPU time).</li><li><B>&lt;value&gt;</B>: The numerical limit for the resource or the keyword <I>unlimited</I> for no restriction.</li></ul>


title: <B>COMMON RESOURCE ITEMS</B>
content:
The <B>&lt;item&gt;</B> field in <I>limits.conf</I> can specify various system resources to be limited. Common items include:<br><ul><li><B>core</B>: Maximum size of core files (in kilobytes).</li><li><B>data</B>: Maximum data segment size (in kilobytes).</li><li><B>fsize</B>: Maximum file size (in kilobytes) that can be created.</li><li><B>memlock</B>: Maximum locked-in-memory address space (in kilobytes).</li><li><B>nofile</B>: Maximum number of open file descriptors.</li><li><B>nproc</B>: Maximum number of processes that can be created by the user.</li><li><B>rss</B>: Maximum resident set size (in kilobytes).</li><li><B>stack</B>: Maximum stack size (in kilobytes).</li><li><B>cpu</B>: Maximum CPU time (in minutes).</li><li><B>rtprio</B>: Maximum real-time priority for processes.</li><li><B>msgqueue</B>: Maximum POSIX message queue size (in bytes).</li><li><B>nice</B>: Maximum nice priority allowed to raise (a negative value indicates a higher priority).</li><li><B>sigpending</B>: Maximum number of pending signals.</li><li><B>locks</B>: Maximum number of file locks held.</li></ul>


title: HISTORY
content:
<I>pam_limits</I> has been a fundamental and long-standing module in <B>Linux-PAM</B> since its early development. It provides a standard and flexible way to enforce system-wide resource management policies, evolving alongside the PAM framework itself to integrate seamlessly into modern Linux environments. Its core purpose – applying user-defined resource limits at the time of session establishment – has remained consistent throughout its history.


title: SEE ALSO
content:
<B>limits.conf(5)</B>: The manual page describing the format and usage of the system resource limits configuration file., <B>pam(8)</B>: The main manual page providing an overview of Pluggable Authentication Modules., <B>ulimit(1)</B>: A shell builtin command used to get or set resource limits for the current shell environment and its child processes., <B>getrlimit(2)</B>, <B>setrlimit(2)</B>: System calls used internally by <I>pam_limits</I> and other applications to manage resource limits.


title: SYNOPSIS
content:
<b>pam_listfile.so</b> [options] <b>onitem=</b>{<i>user|group|tty|rhost|ruser|service|fgroup|pgrp</i>} <b>sense=</b>{<i>allow|deny</i>} <b>file=</b><i>/path/to/file</i>


title: PARAMETERS
content:
<b><b>onitem=</b>{<i>user|group|tty|rhost|ruser|service|fgroup|pgrp</i>}</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the type of item to be checked against the list file.<br><b>user</b>: User's login name.<br><b>group</b>: User's primary group name.<br><b>tty</b>: Terminal name (e.g., <i>/dev/pts/0</i>).<br><b>rhost</b>: Remote host name.<br><b>ruser</b>: Remote user name.<br><b>service</b>: PAM service name.<br><b>fgroup</b>: Effective group name.<br><b>pgrp</b>: Primary group name (from <i>getpwuid()</i>).<br><br><b><b>sense=</b>{<i>allow|deny</i>}</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Determines the module's action if the item is found in the list file.<br><b>allow</b>: If found, access is granted (returns <i>PAM_SUCCESS</i>). If not found, access is denied (returns <i>PAM_AUTH_ERR</i>).<br><b>deny</b>: If found, access is denied (returns <i>PAM_AUTH_ERR</i>). If not found, access is granted (returns <i>PAM_SUCCESS</i>).<br><br><b><b>file=</b><i>/path/to/file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the absolute path to the list file containing items, one per line by default.<br><br><b><b>nullok</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the item to be checked is <i>NULL</i> (e.g., <i>rhost</i> for a local login), the module returns <i>PAM_SUCCESS</i> instead of denying access or ignoring. Use with caution.<br><br><b><b>reverse</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Inverts the meaning of the <b>sense</b> argument. If <b>sense=allow</b> is used with <b>reverse</b>, it behaves like <b>sense=deny</b> and vice-versa.<br><br><b><b>nonull</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the item to be checked is <i>NULL</i>, the module returns <i>PAM_AUTH_ERR</i> (access denied). This is the opposite of <b>nullok</b> and cannot be used with it.<br><br><b><b>apply</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Modifies <b>nullok</b> behavior. If <b>nullok</b> is present and the item is <i>NULL</i>, the module returns <i>PAM_IGNORE</i> instead of <i>PAM_SUCCESS</i> (PAM 1.0) or <i>PAM_SUCCESS</i> (PAM 1.1), allowing subsequent modules to determine access.<br><br><b><b>debug</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging messages to be logged via syslog.<br><br><b><b>quiet</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses informational messages to syslog about allowing or denying access.<br><br><b><b>field=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(PAM 1.4.0+) Specifies that the N-th field (column) in the list file should be matched. Fields are 1-indexed. Default is 1.<br><br><b><b>sep=</b><i>char</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(PAM 1.4.0+) Specifies the character used as a field separator in the list file. Default is whitespace.<br><br><b><b>comment=</b><i>char</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(PAM 1.4.0+) Specifies the character that denotes the start of a comment in the list file. Default is '#'.<br><br>


title: DESCRIPTION
content:
<i>pam_listfile</i> is a Pluggable Authentication Module (PAM) that allows or denies access based on whether a specific item (like a user, group, or TTY) is listed in a designated file. It provides a flexible and simple mechanism for implementing access policies directly within the PAM authentication stack. This module is typically configured in PAM service files (e.g., <i>/etc/pam.d/sshd</i>) to control access to system services. It can be used to create allow-lists (whitelists) or deny-lists (blacklists) for various system entities, offering granular control over who can access what, based on predefined lists maintained by the system administrator.


title: CAVEATS
content:
The order of PAM modules in a service configuration file is critical, as modules are processed sequentially. Misconfiguring <i>pam_listfile</i> can lead to unintended access restrictions or security vulnerabilities. Ensure the list file's permissions are properly secured (e.g., readable only by root) to prevent unauthorized modification. For very large list files, there might be a minor performance overhead.


title: CONFIGURATION EXAMPLE
content:
To deny SSH access to users listed in <i>/etc/ssh/denied_users</i>:<br><br>Add the following line to <i>/etc/pam.d/sshd</i> (typically in the <i>auth</i> section):<br><i><br>auth required pam_listfile.so onitem=user sense=deny file=/etc/ssh/denied_users<br></i><br>And create the file <i>/etc/ssh/denied_users</i> with one username per line:<br><i><br>baduser1<br>baduser2<br></i>


title: LIST FILE FORMAT
content:
By default, the list file should contain one item per line. Blank lines are ignored. Lines starting with '#' (or the character specified by <b>comment</b>) are treated as comments.<br><br>Example <i>/etc/ssh/allowed_ttys</i> (allowing SSH only from console and pts/0):<br><i><br>/dev/console<br>/dev/pts/0<br></i><br>With <b>field</b> and <b>sep</b>, the file can be more complex, e.g., matching the second field separated by colons:<br><i><br># username:uid:group<br>john:1001:users<br>jane:1002:staff<br></i><br>To match 'john' using <i>pam_listfile.so ... onitem=user sense=allow file=/path/to/file field=1 sep=:<br></i>


title: SYNOPSIS
content:
<I>pam_localuser</I> is a PAM module and is configured within PAM service files (e.g., <I>/etc/pam.d/sshd</I>). It is not executed as a standalone command.<br><br>The general syntax in a PAM configuration file is:<br><b><I>auth [control_flag] pam_localuser.so [options]</I></b><br><br>Example:<br><b><I>auth required pam_localuser.so file=/etc/my_local_users group=sudo sense=allow</I></b>


title: PARAMETERS
content:
<b><b>file=<I>/path/to/passwd</I></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative local password file to check against, instead of the system's default <I>/etc/passwd</I>.<br><br><b><b>group=<I>name</I></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instructs the module to check if the user is a member of the specified local group (<I>name</I>) in <I>/etc/group</I> (or the file specified by <I>file</I>). If this option is used, the module checks group membership instead of simple presence in the password file.<br><br><b><b>sense=allow|deny</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Controls the module's success condition:<br><b>allow</b>: The module succeeds if the user is found in the local password file (or in the specified group, if <I>group</I> is used). This is the default if <I>sense</I> is not specified.<br><b>deny</b>: The module succeeds if the user is <I>not</I> found in the local password file (or <I>not</I> in the specified group, if <I>group</I> is used).<br><br>


title: DESCRIPTION
content:
The <b>pam_localuser</b> module is a <I>Pluggable Authentication Module</I> (PAM) designed to check if an authenticating user is a 'local' user. A local user is typically defined as an entry found in the system's local password database, such as <I>/etc/passwd</I>, rather than a user managed by network services like LDAP, Kerberos, or NIS.<br><br>This module is primarily used in the <I>auth</I> PAM stack, allowing administrators to differentiate authentication requirements based on a user's origin. For instance, you might want to grant special privileges or deny access to certain services if a user is not local or, conversely, ensure only local users can access a specific service.<br><br>It can also be configured to check for membership in a specific local group, providing finer-grained control over who is considered 'local' for a given service. By default, it succeeds if the user is found locally; however, this logic can be inverted.


title: CAVEATS
content:
The definition of 'local' for <I>pam_localuser</I> strictly refers to entries in the <I>/etc/passwd</I> and <I>/etc/group</I> files (or an alternative file specified). It does not consult NSSwitch (Name Service Switch) or other directories. Thus, if a user exists via LDAP but not in <I>/etc/passwd</I>, they are considered 'non-local' by this module.


title: PAM CONTROL FLAGS
content:
While not specific to <I>pam_localuser</I>, its behavior within the PAM stack is heavily influenced by the control flags specified before the module, such as <B>required</B>, <B>requisite</B>, <B>sufficient</B>, and <B>optional</B>. These flags dictate how the success or failure of <I>pam_localuser</I> affects the overall authentication process for a given service. For example, <B>auth required pam_localuser.so</B> would mean that the user <I>must</I> be local for authentication to proceed.


title: TYPICAL USE CASES
content:
Common uses include:<br>- Restricting SSH or console logins only to users defined in <I>/etc/passwd</I>.<br>- Ensuring that users in a specific administrative group are also local users.<br>- Allowing non-local users to access certain services while denying them others.


title: HISTORY
content:
PAM (Pluggable Authentication Modules) was developed in the mid-1990s to provide a modular and flexible authentication framework. <I>pam_localuser</I> is one of the core modules that has been part of the PAM suite since its early days, fulfilling the fundamental need to distinguish between system-native users and those managed by external authentication sources.


title: SYNOPSIS
content:
To use <i>pam_loginuid</i>, it is configured within PAM service configuration files, typically in the <b>session</b> stack. The common syntax is:<br><br><b>session required pam_loginuid.so</b> <i>[options]</i><br><br>or<br><br><b>session optional pam_loginuid.so</b> <i>[options]</i><br><br>Place this entry early in the <b>session</b> stack of relevant PAM configuration files (e.g., <i>/etc/pam.d/login</i>, <i>/etc/pam.d/sshd</i>, <i>/etc/pam.d/sudo</i>).


title: PARAMETERS
content:
<b>require_audit_info</b><br>&nbsp;&nbsp;&nbsp;&nbsp;This option makes the module only attempt to set the <b>loginuid</b> if audit information (like session ID) is already available. If not, it skips setting the <b>loginuid</b> rather than failing.<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debug messages to be logged via syslog, which can be useful for troubleshooting PAM configurations.<br><br><b>strict</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If specified, the module will fail the PAM authentication if it is unable to set the <b>loginuid</b>. This typically happens if the process is not a session leader (e.g., a background daemon not initiated by a login). By default, the module silently succeeds if it cannot set the <b>loginuid</b> in such cases.<br><br><b>no_autopause</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Systemd specific) Prevents systemd from automatically pausing the session when <b>loginuid</b> is set. This is rarely needed for typical PAM configurations.<br><br><b>allow_non_tty</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Systemd specific) Allows the module to attempt to set <b>loginuid</b> even if no TTY is associated with the session. Useful for services that run without a TTY but still require audit tracking.<br><br>


title: DESCRIPTION
content:
<i>pam_loginuid</i> is a Pluggable Authentication Module (PAM) that is responsible for setting the kernel's <b>loginuid</b> for a user's session. The <b>loginuid</b> is a special identifier associated with a process, indicating the original user who logged in and initiated the session. This ID is crucial for the Linux Audit Subsystem, as it allows all subsequent audit events originating from that session, regardless of any later UID changes (e.g., via <i>su</i> or <i>sudo</i>), to be correctly attributed to the original user. This ensures a consistent and traceable audit trail for security and compliance purposes.<br><br>The module is typically configured as a <b>session</b> module in PAM service files (e.g., <i>/etc/pam.d/sshd</i>, <i>/etc/pam.d/login</i>). It should ideally be the first module in the session stack to set the <b>loginuid</b>. If the <b>loginuid</b> is already set (e.g., by <i>sudo</i>), <i>pam_loginuid</i> will not overwrite it, ensuring that the original session initiator remains correctly identified.


title: CAVEATS
content:
The <b>loginuid</b> can only be set once per process. If it's already set (e.g., by an earlier PAM module or by <i>sudo</i>), <i>pam_loginuid</i> will not overwrite it. It's crucial for the process to be a session leader for <i>pam_loginuid</i> to function correctly. Processes not initiated by a direct login (like those started by <i>at</i> or <i>cron</i>) might not have a <b>loginuid</b> set unless specifically handled by their parent process. Ensure the Linux Audit Subsystem is active and running (e.g., <i>auditd</i> service) for the <b>loginuid</b> to be effectively utilized.


title: CONFIGURATION EXAMPLE
content:
To configure <i>pam_loginuid</i>, you typically add a line to the <b>session</b> stack of relevant PAM configuration files. For example, in <i>/etc/pam.d/sshd</i> for SSH logins:<br><br><b>session required pam_loginuid.so</b><br><br>This ensures that every SSH session initiated by a user has its <b>loginuid</b> set to that user's ID, enabling proper auditing of all actions performed within that session.


title: INTERACTION WITH SUDO AND SU
content:
When a user logs in, <i>pam_loginuid</i> sets their <b>loginuid</b>. If that user then uses <i>sudo</i> or <i>su</i> to change their effective user ID, the original <b>loginuid</b> typically persists. This means that even if a user becomes <i>root</i>, all audit events are still logged with the <b>loginuid</b> of the original user who logged in, providing a complete audit trail that tracks who initiated the session, regardless of subsequent privilege escalation.


title: HISTORY
content:
The concept of an auditable user ID, or <b>loginuid</b>, has been an integral part of the Linux Audit Subsystem since its inception. <i>pam_loginuid</i> emerged as a necessary PAM module to automate the setting of this critical identifier upon user login, ensuring that audit events are consistently linked to the initial session creator. Its development paralleled the maturation of the Linux audit framework, providing a robust, user-space mechanism to integrate session tracking directly with system authentication and authorization processes managed by PAM. While the core functionality has remained stable, minor enhancements and options have been added over time to address specific deployment scenarios and interactions with other system components like <i>systemd</i>.


title: SYNOPSIS
content:
pam_mail is not a standalone command but a PAM module configured in <I>/etc/pam.d/service-name</I> files. Its typical usage within a PAM configuration file is:<br><br><I>auth</I> <I>optional</I> <I>pam_mail.so</I> <I>[options]</I><br><I>session</I> <I>optional</I> <I>pam_mail.so</I> <I>[options]</I><br><br>Where <I>service-name</I> is the PAM service (e.g., <I>login</I>, <I>sshd</I>), <I>auth</I> or <I>session</I> specifies the PAM module type, <I>optional</I> is a control flag, <I>pam_mail.so</I> is the module library, and <I>[options]</I> are zero or more module-specific parameters.


title: PARAMETERS
content:
<b>noopen</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instructs the module not to open the mail spool file; it will only check for its existence and modification times.<br><br><b>nocheck</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from checking for new mail. It will only warn if an empty mail spool file exists.<br><br><b>emptyok</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses warnings if the mail spool file is empty.<br><br><b>standard</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the module to check only the standard mail spool location, typically <I>/var/spool/mail/$USER</I>. Mutually exclusive with <I>dir</I>.<br><br><b>dir=directory</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative directory to check for mail spool files. Overrides the <I>standard</I> option and is mutually exclusive with it.<br><br><b>hash=N</b><br>&nbsp;&nbsp;&nbsp;&nbsp;When checking Maildir-style spools, this limits the number of directories to search within the <I>tmp</I>, <I>new</I>, and <I>cur</I> subdirectories to <I>N</I>. A value of <I>0</I> means no limit.<br><br><b>quiet</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from printing any messages to the user; it only returns success or failure.<br><br><b>noenv</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from setting the <I>MAIL</I> and <I>MAIL_DIR</I> environment variables for the user's session.<br><br>


title: DESCRIPTION
content:
pam_mail is a Pluggable Authentication Modules (PAM) module designed to notify users of new mail during the login process. It integrates seamlessly into the PAM authentication and session management stack, typically configured within files in the /etc/pam.d/ directory.<br><br>When used as a <I>session</I> module, it checks the user's mail spool for new messages and, if new mail is found, it will print a message to the user's terminal, often displaying the number of new and old messages. As an <I>auth</I> module, it can be used to ensure the mail spool is present, returning success or failure accordingly. The module supports both traditional mbox-style mail spools (e.g., /var/spool/mail/$USER) and Maildir-style setups (e.g., ~/Maildir), with various options available to customize its behavior, such as specifying mail directories, suppressing messages, or controlling environment variable settings. Its primary goal is to enhance user experience by providing timely mail notifications post-authentication.


title: CAVEATS
content:
pam_mail relies on the system's mail spool conventions. Misconfiguration of mail spools or mail clients might lead to incorrect notifications or none at all.<br><br>The <I>standard</I> and <I>dir</I> options are mutually exclusive; using both will result in an error or unexpected behavior.<br><br>For security-sensitive environments, ensure that mail spool directories have appropriate permissions to prevent unauthorized access, as pam_mail directly interacts with these files.<br><br>When used as an <I>auth</I> module, it primarily checks for the <I>presence</I> of a mail spool, not necessarily new mail, which might not be its intended use case for most systems. It's more commonly used in the <I>session</I> phase.


title: PAM STACK INTEGRATION
content:
pam_mail is typically placed in the <I>session</I> type stack in PAM configuration files (e.g., <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>). This ensures that the module runs after successful authentication, just before the user's session is fully established, allowing it to display mail notifications directly to the user's terminal. If placed in the <I>auth</I> stack, its primary function is to check for the mail spool's existence, returning success or failure, rather than providing interactive notifications.


title: MAIL SPOOL LOCATIONS
content:
By default, pam_mail checks common mail spool locations. For traditional mbox format, this is typically <I>/var/spool/mail/username</I>. For Maildir format, it looks for <I>~/Maildir</I> or other standard Maildir paths within the user's home directory. The module intelligently handles both types, but explicit <I>dir</I> or <I>standard</I> options can override this auto-detection for specific configurations.


title: HISTORY
content:
pam_mail is part of the Linux-PAM (Pluggable Authentication Modules for Linux) project, which originated in the mid-1990s as a flexible way to manage authentication services independent of applications. PAM was initially developed by Sun Microsystems and later adopted and extended by the Linux community. pam_mail was included as one of the standard modules to provide a common service of notifying users about new mail, integrating this functionality directly into the login and session establishment process, rather than requiring applications to implement it separately. Its design reflects the modular philosophy of PAM, allowing administrators to easily add or remove this specific functionality without modifying application code.


title: SYNOPSIS
content:
<i>pam_mkhomedir</i> is a PAM module configured within PAM configuration files, typically found in the <i>/etc/pam.d/</i> directory. Its configuration follows the standard PAM module syntax:<br><b>module_type</b> <b>control_flag</b> <b>module_path</b> [<b>options</b>]<br>For <i>pam_mkhomedir</i>, it is almost exclusively used as a <b>session</b> module, often with the <b>optional</b> control flag:<br><i>session optional pam_mkhomedir.so [options]</i><br>Common placements include <i>/etc/pam.d/common-session</i> or <i>/etc/pam.d/system-auth</i>, ensuring it runs for most login types.


title: PARAMETERS
content:
<b>skel=/path/to/skel</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative skeleton directory from which to copy files and directories for the new home directory. The default is <i>/etc/skel</i>.<br><br><b>umask=0XXX</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the umask (file mode creation mask) to be applied when creating the home directory. This masks out specific permission bits. The default umask is 077.<br><br><b>mode=0XXX</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the explicit permission mode (octal) for the newly created home directory. This option overrides any specified <b>umask</b>. The default mode is 0700.<br><br><b>subdir_perms=0XXX</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the permissions (octal) for any subdirectories copied from the skeleton directory. The default is 0700.<br><br><b>usergroups</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If specified, ensures that a user's private group (UPG) is created if it does not already exist. This is useful for systems where UPGs are not automatically handled by user creation tools.<br><br><b>silent</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses output messages to stderr, making operations quieter and reducing log verbosity.<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables debug logging for the module, providing more verbose output to assist with troubleshooting and understanding module behavior.<br><br>


title: DESCRIPTION
content:
The <i>pam_mkhomedir</i> module is a Pluggable Authentication Module (PAM) designed to automatically create a user's home directory if it does not already exist upon their first successful login. This module is essential for simplifying user management in multi-user systems, as it automates a typically manual setup step. Upon creation, it populates the new home directory by copying files and directories from a specified skeleton directory, usually <i>/etc/skel</i>, ensuring new users have a consistent and pre-configured environment. It also handles setting the correct ownership and permissions for the newly created directory, which is crucial for security and user privacy. <i>pam_mkhomedir</i> is commonly configured within the PAM <b>session</b> stack, allowing it to execute during the establishment of a user's login session.


title: CAVEATS
content:
Incorrect configuration of <b>umask</b> or <b>mode</b> options can lead to insecure home directories with overly permissive settings. The module only creates the home directory and copies skeleton files; it does not handle the creation of the user account itself. Ensure the specified skeleton directory (e.g., <i>/etc/skel</i>) is secure and contains only appropriate default files and settings. For correct functionality, the module must be placed within the <b>session</b> stack of PAM configuration files.


title: MODULE TYPE AND CONTROL FLAG USAGE
content:
<i>pam_mkhomedir</i> is almost exclusively configured as a <b>session</b> module. This type signifies that it runs when a user's session is being established (or terminated). The most common control flag associated with it is <b>optional</b>. An <b>optional</b> flag means that if the module encounters a non-critical failure (e.g., low disk space preventing directory creation), the overall authentication or session establishment process will still continue, preventing a user from being locked out. While other flags like <b>required</b> could be used for stricter enforcement, <b>optional</b> is typically preferred to balance security with usability for home directory creation.


title: THE ROLE OF <I>/ETC/SKEL</I>
content:
The <i>/etc/skel</i> directory serves as the default template for new user home directories created by <i>pam_mkhomedir</i>. It should contain standard dotfiles (e.g., <i>.bashrc</i>, <i>.profile</i>, <i>.config/</i>) and any other default directories or files that users need upon their first login. Maintaining and securing this directory is critical, as its contents are replicated for every new user, directly impacting their initial environment and the system's security posture.


title: HISTORY
content:
The <i>pam_mkhomedir</i> module is a fundamental component of the Linux-PAM (Pluggable Authentication Modules) framework, which emerged as a standard for modularizing authentication services on Linux systems. It has been present since the early days of Linux-PAM, addressing the common need for automatic home directory provisioning in multi-user environments. Its development was driven by the goal of simplifying system administration tasks, ensuring that new user accounts are consistently set up with their necessary home directories and default configurations without requiring manual intervention, thereby enhancing both efficiency and security.


title: SYNOPSIS
content:
This module is typically configured in a PAM service file (e.g., <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>) as a <I>session</I> type module.<br><br><b>session optional pam_motd.so</b> [<I>motd=/path/to/file</I>] [<I>motd_dir=/path/to/dir</I>] [<I>noupdate</I>] [<I>warn</I>] [<I>nonr</I>] [<I>debug</I>]


title: PARAMETERS
content:
<b>motd=/path/to/file</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative file to read the static message of the day from, instead of the default <I>/etc/motd</I>.<br><br><b>motd_dir=/path/to/dir</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative directory to read dynamic messages from. If this option is used, it typically replaces or supplements the default dynamic MOTD directories like <I>/run/motd.d/</I> and <I>/etc/motd.d/</I>.<br><br><b>noupdate</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from updating the last-display timestamp in <I>/var/run/motd</I>. This timestamp is sometimes used by systems to determine if a new MOTD should be shown.<br><br><b>warn</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If specified, the module will output a warning message to syslog if it fails to open the MOTD file or directory.<br><br><b>nonr</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses trailing newline characters from each message file displayed, preventing extra blank lines after each included message.<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debug messages, which are typically logged to syslog, for troubleshooting purposes.<br><br>


title: DESCRIPTION
content:
<code>pam_motd</code> is a <I>Pluggable Authentication Module</I> (PAM) that is responsible for displaying informational messages to users upon successful login. It typically presents the "message of the day" (MOTD) and other dynamic system information.<br><br>The module first displays the static content of the <I>/etc/motd</I> file. Following this, it processes and displays messages from files and executable scripts found in the <I>/run/motd.d/</I> directory, and then from <I>/etc/motd.d/</I>. These directories allow for dynamic MOTD content, where scripts can generate real-time system status, pending updates, or administrative announcements.<br><br><code>pam_motd</code> is commonly configured as a <I>session</I> module in PAM service files such as <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>, and <I>/etc/pam.d/system-auth</I>. Its primary purpose is to ensure that users are informed about relevant system news, maintenance schedules, or critical notices immediately after authentication. The module's execution is typically set as <I>optional</I> so that a failure in displaying the message does not prevent a user from logging in.


title: CAVEATS
content:
<ul><li><b>Execution Order:</b> <code>pam_motd</code> processes messages in a specific order: first <I>/etc/motd</I>, then files and executables in <I>/run/motd.d/</I>, and finally those in <I>/etc/motd.d/</I>.</li><li><b>Permissions:</b> For dynamic MOTD files and scripts in <I>.d/</I> directories, they must be readable and executable by the user accessing the system. Incorrect permissions can lead to messages not being displayed.</li><li><b>Security Implications:</b> Be cautious when placing executable scripts in MOTD directories (<I>/run/motd.d/</I>, <I>/etc/motd.d/</I>), as they run with the privileges of the logging-in user. Ensure that these scripts are trusted and do not contain vulnerabilities.</li><li><b>Terminal Compatibility:</b> The output of MOTD messages can vary depending on the user's terminal emulator. Complex ASCII art or specific formatting may not render correctly on all terminals.</li></ul>


title: DYNAMIC MOTD GENERATION
content:
Modern Linux distributions leverage <code>pam_motd</code> to display dynamic information. This is achieved by placing executable scripts or files in <I>/run/motd.d/</I> and <I>/etc/motd.d/</I>. When a user logs in, <code>pam_motd</code> executes these scripts (if executable) or concatenates their content, allowing for real-time system status reports, administrative announcements, or system-specific warnings to be generated and displayed.


title: PAM SESSION MODULE
content:
<code>pam_motd</code> is configured as a <I>session</I> module in PAM. This means it is invoked after successful authentication and before the user's session is fully established. It's typically added with the `optional` keyword, ensuring that if the module fails to display the message (e.g., due to file permission issues), the login process is not interrupted.


title: HISTORY
content:
The concept of a "message of the day" is a long-standing Unix tradition, predating the PAM framework. Historically, login programs would directly display the contents of <I>/etc/motd</I>. With the introduction of <I>Pluggable Authentication Modules</I> (PAM) in the mid-1990s, the responsibility for displaying the MOTD was modularized into <code>pam_motd</code>. This transition allowed administrators to control MOTD display behavior more flexibly through PAM configurations. More recently, the functionality evolved from merely displaying a static file to supporting dynamic messages via scripts in directories like <I>/run/motd.d/</I> and <I>/etc/motd.d/</I>. This enhancement enables system administrators to provide up-to-date information, such as system load, pending reboots, or package updates, automatically at login.


title: SYNOPSIS
content:
session required pam_namespace.so [<I>options</I>]<br>session optional pam_namespace.so unmount [<I>options</I>]


title: PARAMETERS
content:
<b><B>unmount</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies that the module should unmount previously mounted namespaces. This is typically used in the <I>session optional</I> line for cleanup at logout.<br><br><b><B>mount</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Default behavior) Specifies that the module should mount namespaces as defined in the configuration file. This is usually implied if <I>unmount</I> is not present.<br><br><b><B>config=<I>path</I></B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative configuration file to <I>/etc/security/namespace.conf</I>.<br><br><b><B>verbose</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Causes the module to print more verbose debugging information to syslog.<br><br><b><B>debug</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Causes the module to print more detailed debugging information, including internal operations, to syslog.<br><br><b><B>shared</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Makes the mount points shared with the parent namespace, allowing them to propagate to other namespaces. Use with caution as it can reduce isolation.<br><br><b><B>ignore_config_error</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If set, errors encountered while parsing the configuration file will not cause the module to fail.<br><br>


title: DESCRIPTION
content:
The <b><I>pam_namespace</I></b> module is a <I>Pluggable Authentication Module</I> (PAM) designed to manage private namespaces for user sessions. It allows for the creation of isolated temporary directories, such as a user-specific <I>/tmp</I> or <I>/var/tmp</I>, by using <I>tmpfs</I> mounts or bind mounts. This enhances security and privacy by preventing different users from accessing or interfering with each other's temporary files, and ensures that temporary files are cleaned up automatically upon session termination.<br><br>Additionally, it can be used to set up isolated home directories or specific application environments for services, providing a controlled and sandboxed environment. The module reads its configuration from <I>/etc/security/namespace.conf</I> (or a specified file), defining which directories should be made private and how. It typically needs to be configured in the <B>session</B> stack of PAM service files, with one entry for mounting at login and another for unmounting at logout.


title: CAVEATS
content:
<ul><li><B>Cleanup:</B> Proper <I>unmount</I> configuration in the PAM <I>session</I> stack is crucial. If a session terminates abnormally, or if <I>unmount</I> is not configured correctly, bind mounts might persist, leading to resource leaks or unexpected behavior.</li><li><B>Root Privileges:</B> <I>pam_namespace</I> performs mount operations, which require root privileges. PAM handles this by running the module with appropriate permissions.</li><li><B>Interaction with other modules:</B> Be cautious when combining with other PAM modules (e.g., <I>pam_mkhomedir</I>, <I>pam_systemd</I>) that might also affect directory setup or session management.</li><li><B>Security:</B> While it enhances privacy, misconfiguration (e.g., using <I>shared</I> incorrectly) could inadvertently weaken isolation.</li></ul>


title: CONFIGURATION FILE (<I>/ETC/SECURITY/NAMESPACE.CONF</I>)
content:
This file defines the rules for namespace creation. Each line specifies a source, destination, type, and options. Common types include <B>bind</B> (for bind mounts) and <B>tmpfs</B> (for in-memory filesystems).<br><br><b>Example entries:</b><br><I>user tmpfs /tmp rw,nosuid,nodev,size=10M</I> - creates a private, in-memory <I>/tmp</I> for each user session.<br><I>/home/guest /srv/chroots/guest none bind,ro</I> - could bind-mount a guest home directory read-only from a central location.


title: COMMON USE CASES
content:
<ul><li><B>Private /tmp directories:</B> Isolating temporary files created by different users or services for enhanced security and automatic cleanup upon session termination.</li><li><B>Sandboxed Environments:</B> Creating a more controlled and isolated file system environment for specific applications or less trusted users without the overhead of a full chroot or container.</li><li><B>Temporary Home Directories:</B> For certain services or guest accounts, a temporary, isolated home directory can be provided that is cleared after the session.</li></ul>


title: HISTORY
content:
The <I>pam_namespace</I> module is a long-standing component of the PAM ecosystem, designed to leverage Linux kernel namespaces for session isolation. Its development is inherently tied to the evolution of mount namespaces in the kernel, providing a robust and flexible way to manage per-session file system isolation. It is part of the standard <I>pam</I> package, commonly found in most Linux distributions, ensuring widespread availability and integration with system login processes.


title: SYNOPSIS
content:
pam_nologin is a PAM module, not a standalone command executed from the shell. Its usage is defined within PAM configuration files (e.g., <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>) using the following syntax:<br><br><B>type control module-path arguments</B><br><br>Example:<br><B>account required pam_nologin.so</B>


title: PARAMETERS
content:
<b>no_unix_warn</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Do not print the traditional "System is going down" warning message if the module fails due to the nologin file.<br><br><b>fail_now</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If this module returns <I>PAM_AUTH_ERR</I> (e.g., due to /etc/nologin existing), immediately terminate the authentication process without processing subsequent modules in the PAM stack.<br><br>


title: DESCRIPTION
content:
pam_nologin is a <I>Pluggable Authentication Module</I> (<I>PAM</I>) that restricts system access for regular users. It checks for the existence of the files <I>/etc/nologin</I> or <I>/run/nologin</I>. If either of these files exists, and the user attempting to log in is <B>not</B> <I>root</I>, pam_nologin will prevent the login. The content of the <I>nologin</I> file is typically displayed to the user as a message explaining why they cannot log in. This module is commonly used by system administrators to temporarily prevent normal user logins during maintenance periods, upgrades, or system shutdowns, allowing only the <I>root</I> user to access the system for critical operations. It is usually configured as an <I>account</I> or <I>auth</I> type in PAM configuration files like <I>login</I>, <I>sshd</I>, or <I>ftp</I>.


title: CAVEATS
content:
<b>Affects all services configured with <I>pam_nologin</I>.</b><br><b>Only</b> prevents non-root users from logging in; the <I>root</I> user can still log in.<br>The <I>nologin</I> file (<I>/etc/nologin</I> or <I>/run/nologin</I>) must be deleted after maintenance to re-enable normal user logins.<br>Can be bypassed if other authentication methods (e.g., SSH keys with <I>PermitRootLogin yes</I>) are not properly restricted or if PAM is misconfigured for a service.


title: CONFIGURATION LOCATION
content:
<I>pam_nologin</I> is configured in files located in <I>/etc/pam.d/</I>, for example, <I>/etc/pam.d/login</I>, <I>/etc/pam.d/sshd</I>, or <I>/etc/pam.d/ftp</I>. The module typically appears with the <I>account</I> or <I>auth</I> control flags.


title: NOLOGIN FILE CONTENT
content:
The text contained within <I>/etc/nologin</I> or <I>/run/nologin</I> is displayed to users attempting to log in, providing them with a reason for the access restriction.


title: HISTORY
content:
PAM (Pluggable Authentication Modules) was developed by Sun Microsystems in the mid-1990s. <I>pam_nologin</I> is a standard module included in most PAM implementations, providing a simple yet effective mechanism for system-wide login control during critical operations. Its core function has remained largely consistent over time.


title: PARAMETERS
content:
<b>No module-specific options</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The <b>pam_permit</b> module does not accept any specific parameters that alter its behavior. It always succeeds. General PAM control flags (e.g., <i>debug</i>, <i>no_warn</i>) can be applied to its entry in a PAM configuration file, but these are handled by the PAM framework itself, not by the <b>pam_permit</b> module.<br><br>


title: DESCRIPTION
content:
The <b>pam_permit</b> module is a fundamental component of the Pluggable Authentication Modules (PAM) framework on Linux. Unlike typical commands invoked directly from the shell, <b>pam_permit</b> is a shared library (<i>pam_permit.so</i>) used within PAM configuration files (e.g., in <i>/etc/pam.d/</i>). Its sole and simple purpose is to unconditionally succeed, meaning it always grants access or authorizes the action for which it is called within a PAM stack, without performing any checks. This makes it a useful building block, often placed at the end of a PAM stack or used in scenarios where no specific authentication or authorization is required but a PAM module must still return a success code. It's crucial for configuring services that might not require a traditional login but still interact with the PAM system.


title: CAVEATS
content:
Using <b>pam_permit</b> carelessly can introduce significant security vulnerabilities, as it bypasses all authentication and authorization checks. It should only be used when absolutely certain that no checks are needed, or as a fail-safe at the end of a carefully constructed PAM stack where other modules have already performed necessary validations. Placing it too early in a PAM stack with an inappropriate control flag (e.g., <i>required</i> or <i>sufficient</i>) could effectively nullify all subsequent security measures.


title: USAGE CONTEXT
content:
<b>pam_permit</b> is never invoked directly from the command line by a user. Instead, it is configured within PAM service files located typically in <i>/etc/pam.d/</i>. Each entry specifies a module type (e.g., <i>auth</i>, <i>account</i>, <i>password</i>, <i>session</i>), a control flag (e.g., <i>required</i>, <i>sufficient</i>, <i>optional</i>, <i>requisite</i>), and the module path (<i>pam_permit.so</i>). The PAM system loads and executes these modules in sequence based on the configuration.


title: ROLE IN PAM STACKS
content:
While seemingly counterintuitive, <b>pam_permit</b> plays an important role in complex PAM stacks. For instance, it can be used with the <i>sufficient</i> control flag to provide a default 'allow' if no other module explicitly denies access, or with <i>optional</i> to indicate that its success is not strictly necessary but contributes to the overall result. It's often seen at the very end of a stack, or in conjunction with other modules that might fail gracefully without a specific 'allow' module to finalize the decision.


title: HISTORY
content:
PAM (Pluggable Authentication Modules) was originally developed by Sun Microsystems in the early 1990s to provide a flexible authentication framework. The Linux-PAM project later adopted and expanded upon this concept. The <b>pam_permit</b> module, being a fundamental primitive that simply returns success, has been an integral part of the PAM system since its early iterations. Its existence is crucial for enabling the modularity of PAM, allowing administrators to construct authentication policies by combining various modules, including those that offer unconditional success or failure.


title: SYNOPSIS
content:
This is a PAM module, configured in PAM service files.<br>Typical usage in <i>/etc/pam.d/</i> files under the <b>password</b> stack:<br><br><code>password <I>control</I> pam_pwhistory.so [<I>options</I>]</code><br><br>Where <i><I>control</I></i> can be <b>required</b>, <b>requisite</b>, <b>sufficient</b>, or <b>optional</b>, defining the module's success/failure behavior within the PAM stack. <i><I>options</I></i> are module-specific arguments.


title: PARAMETERS
content:
<b>remember=N</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the number of previous passwords to remember for each user. An attempt to set a password that matches any of the <b>N</b> remembered passwords will be rejected. The default value is typically 10.<br><br><b>enforce_for_root</b><br>&nbsp;&nbsp;&nbsp;&nbsp;By default, the root user is exempt from password history checks. This option forces <i>pam_pwhistory</i> to apply the history check to the root user as well.<br><br><b>dir=/path/to/dir</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative directory where the password history file (<i>opasswd</i>) is stored. The default location is <i>/etc/security</i>.<br><br><b>fail_no_update</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If this option is set, the password change will fail if the password history cannot be successfully updated (e.g., due to permissions issues or disk space problems). Without this, the password change might proceed, but the history will not be updated.<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging information, which is typically logged to syslog for troubleshooting purposes.<br><br><b>use_authtok</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instructs the module to use the password provided by the <i>auth</i> stack rather than interactively prompting the user for a new password. Useful for non-interactive password changes.<br><br><b>store_hashes=algorithm</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Deprecated) Specifies the hashing algorithm (e.g., <b>md5</b>, <b>sha512</b>) to use when storing old passwords. It is recommended to rely on <i>libpwquality</i> for robust password hashing.<br><br>


title: DESCRIPTION
content:
The <i>pam_pwhistory</i> module is a Pluggable Authentication Module (PAM) component designed to enhance system security by preventing users from reusing their old passwords. When integrated into the PAM password stack (typically within files like <i>/etc/pam.d/passwd</i> or <i>/etc/pam.d/system-auth</i>), it remembers a user's previous passwords. During a password change operation, <i>pam_pwhistory</i> checks the newly provided password against a stored history of hashes of the user's past passwords. If the new password matches any of the remembered ones, the module prevents the password change, forcing the user to choose a truly new password. This mechanism significantly reduces the risk associated with password recycling, a common weak security practice that makes accounts vulnerable to brute-force attacks or dictionary attacks if an old password is ever compromised.


title: CAVEATS
content:
<b><I>File Permissions:</I></b> The password history file (<i>/etc/security/opasswd</i> or the specified <i>dir</i>) must have strict permissions, typically owned by root with 600 or 640 permissions, to prevent unauthorized access to hashed old passwords.<br><br><b><I>Scalability:</I></b> For systems with a very large number of local users, the <i>opasswd</i> file can grow significantly, potentially impacting performance or disk space. Centralized identity management systems (like LDAP, FreeIPA) often have their own built-in password history mechanisms that may be more scalable.<br><br><b><I>Root Exemption:</I></b> Remember to use the <b>enforce_for_root</b> option if you wish to apply password history policies to the root user, as they are exempt by default.


title: HOW IT WORKS
content:
When <i>pam_pwhistory</i> is invoked as part of the password change process, it takes the user's new password and hashes it. It then compares this hash against a list of hashes of the user's previously used passwords, which are typically stored in the <i>/etc/security/opasswd</i> file (or a specified alternative directory). If a match is found, the password change is rejected. If the change is allowed, the hash of the new password is added to the user's history list, and the oldest hash is removed to maintain the specified 'remember' count. Only password hashes are stored, not the plain-text passwords.


title: CONFIGURATION EXAMPLE
content:
To enable <i>pam_pwhistory</i> and remember 5 previous passwords for all users (including root), you might add or modify a line in your <i>/etc/pam.d/passwd</i> or <i>/etc/pam.d/system-auth</i> file (depending on your distribution's PAM setup) under the <b>password</b> stack:<br><br><code>password required pam_pwhistory.so remember=5 enforce_for_root</code><br><br>The <b>required</b> control flag means that this module must succeed for the overall password change operation to succeed, and its failure will cause the entire password change to fail.


title: HISTORY
content:
PAM (Pluggable Authentication Modules) was originally developed by Sun Microsystems in the mid-1990s to provide a flexible authentication framework. The Linux-PAM project brought this architecture to Linux systems. The <i>pam_pwhistory</i> module emerged as a crucial component to enforce a fundamental security policy: preventing users from reusing old passwords. This addresses a common vulnerability where users might cycle between a small set of passwords, making them easier to guess or crack if an old password is compromised. Its development reflects the ongoing effort to improve password security practices on Unix-like systems, emphasizing policy enforcement at the authentication layer.


title: SYNOPSIS
content:
<I>The <b>pam_rhosts</b> module is configured in PAM service files, typically located in <b>/etc/pam.d/</b>. It is usually placed in the <b>auth</b> or <b>account</b> module types. Its syntax in a PAM configuration file follows the general PAM module syntax:<br><br><b>auth</b> <I>required</I> <b>pam_rhosts.so</b> <I>[module_options]</I><br><b>account</b> <I>required</I> <b>pam_rhosts.so</b> <I>[module_options]</I><br><br>Where <I>module_options</I> are specific arguments passed to the module to modify its behavior.</I>


title: PARAMETERS
content:
<b>no_hosts_equiv</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Do not consult the system-wide <b>/etc/hosts.equiv</b> file.</I><br><br><b>no_rhosts</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Do not consult the user's home directory <b>~/.rhosts</b> file.</I><br><br><b>allow_root</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Permit root authentication via <b>hosts.equiv</b> (highly insecure and generally discouraged).</I><br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Enable verbose debugging messages to syslog.</I><br><br><b>no_warn</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Do not issue warnings when authentication fails due to conditions like missing files or permissions.</I><br><br><b>debug_rhosts</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Similar to <b>debug</b>, specifically for R-command related debugging.</I><br><br><b>no_wait</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Return immediately if authentication fails; do not wait for a delay.</I><br><br><b>set_user</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Changes the effective user ID of the calling process to the authenticated user. Used by some PAM services.</I><br><br>


title: DESCRIPTION
content:
<I>The <b>pam_rhosts</b> module is a Pluggable Authentication Module (PAM) designed to authenticate users based on the legacy <b>.rhosts</b> and <b>/etc/hosts.equiv</b> files. It is primarily used to provide compatibility with the insecure R-commands like <b>rsh</b>, <b>rlogin</b>, and <b>rcp</b>, which rely on a "trusted host" mechanism. When configured in a PAM service file (e.g., <b>/etc/pam.d/rlogin</b>), <b>pam_rhosts</b> checks if the remote host and user are listed as trusted, allowing access without a password. This module implements the <b>auth</b> and <b>account</b> PAM module types. While it fulfills the historical requirement for R-command authentication, its reliance on host-based trust, which can be easily spoofed or misconfigured, makes it a significant security risk. Modern systems strongly discourage its use in favor of more secure authentication methods like SSH.</I>


title: CAVEATS
content:
<I>The <b>pam_rhosts</b> module is inherently insecure due to its reliance on trusting remote host IP addresses, which can be spoofed. It also depends on accurate DNS resolution and properly secured <b>.rhosts</b> and <b>hosts.equiv</b> files. Misconfigurations or weak permissions on these files can lead to unauthorized access. It does not provide encryption for data in transit, making it vulnerable to eavesdropping. Its use is strongly discouraged in modern network environments; secure alternatives like SSH should always be preferred.</I>


title: CONFIGURATION EXAMPLE
content:
<I>While generally not recommended, a typical configuration for <b>pam_rhosts</b> in a PAM service file (e.g., <b>/etc/pam.d/rlogin</b>) might look like this:<br><br><b>auth sufficient pam_rhosts.so</b><br><b>auth required pam_unix.so</b><br><br>In this example, if <b>pam_rhosts</b> successfully authenticates (i.e., the host and user are trusted), the authentication process is considered sufficient, and subsequent modules might be skipped. If <b>pam_rhosts</b> fails, the system falls back to traditional UNIX password authentication via <b>pam_unix.so</b>. This setup allows for legacy R-command trust while still requiring a password if the trust fails.</I>


title: HISTORY
content:
<I>The concept behind <b>pam_rhosts</b> originates from the Berkeley "r-commands" (<b>rsh</b>, <b>rlogin</b>, <b>rcp</b>) developed in the early days of UNIX networking. These commands introduced a host-based authentication mechanism where systems could trust each other based on IP addresses and user mappings in <b>/etc/hosts.equiv</b> and <b>~/.rhosts</b> files. As security became a growing concern, these methods were found to be highly insecure due to IP spoofing, DNS vulnerabilities, and lack of encryption. When PAM was introduced to Linux (around the mid-1990s), <b>pam_rhosts</b> was created to provide backward compatibility for services that still relied on this legacy authentication, allowing administrators to transition systems gradually. However, its usage has steadily declined, and it is now largely considered deprecated for new deployments due to the availability of much more secure alternatives like SSH.</I>


title: SEE ALSO
content:
<I>pam(7)</I>: <I>An overview of the Pluggable Authentication Modules.</I>, <I>ssh(1)</I>: <I>OpenSSH SSH client (secure alternative to R-commands).</I>, <I>rsh(1)</I>: <I>Remote shell (legacy insecure command).</I>, <I>rlogin(1)</I>: <I>Remote login (legacy insecure command).</I>, <I>rcp(1)</I>: <I>Remote file copy (legacy insecure command).</I>, <I>hosts.equiv(5)</I>: <I>Trusted host specification file.</I>, <I>rhosts(5)</I>: <I>Trusted host specification file for individual users.</I>, <I>pam_unix(8)</I>: <I>PAM module for traditional UNIX authentication.</I>


title: SYNOPSIS
content:
As a PAM module, <I>pam_rootok</I> is configured in PAM service files, typically located in <I>/etc/pam.d/</I>.<br><br><b>Syntax within pam.d files:</b><br><br><code>auth &nbsp;&nbsp;[<i>module-type</i>] &nbsp;&nbsp;pam_rootok.so &nbsp;&nbsp;[<i>module-arguments</i>]</code><br><br><b>Example usage:</b><br><br><code>auth &nbsp;&nbsp;sufficient &nbsp;&nbsp;pam_rootok.so</code><br><br>This module does not accept any specific module-arguments.


title: DESCRIPTION
content:
<i>pam_rootok</i> is a <I>Pluggable Authentication Module (PAM)</I> that provides a very simple authentication method: it succeeds if and only if the current effective user ID (EUID) is zero (i.e., the user is <I>root</I>).<br><br>This module is typically used in PAM configurations for services like <I>su</I> or <I>login</I> to allow the root user to always authenticate, even if the password file is corrupted or forgotten, or if other authentication methods fail. It does not perform any password verification or cryptographic checks itself; its sole function is to check the EUID.<br><br>While it provides a crucial fallback mechanism for system administration, it should almost never be used as the sole authentication method for root, especially not on critical services. It is usually combined with other stronger authentication modules (e.g., <I>pam_unix.so</I>) as a <I>sufficient</I> or <I>optional</I> rule, allowing root to bypass password prompts in specific scenarios, or as a last resort in a stack.


title: CAVEATS
content:
Using <I>pam_rootok</I> without other strong authentication modules can be a significant security risk, as anyone gaining root privileges through other means (e.g., a kernel exploit) could then authenticate as root without a password. It should generally be used with care and in conjunction with other robust authentication methods. It authenticates based purely on EUID, not on user identity or credentials.


title: MODULE TYPE
content:
<I>pam_rootok</I> is exclusively an <I>auth</I> type module. It determines whether a user is authenticated based on their effective user ID.


title: TYPICAL CONFIGURATION ROLE
content:
It's often found in the <I>auth</I> stack for services like <I>su</I> or <I>sudo</I>. For instance, in <I>/etc/pam.d/su</I>, you might see it configured as <I>sufficient</I> to allow root to execute <I>su</I> without being prompted for a password, assuming root is already authenticated on the console. It can also be used as a <I>required</I> or <I>optional</I> module depending on the desired authentication flow.


title: HISTORY
content:
The <I>pam_rootok</I> module is a core component of the <I>Linux-PAM</I> (Pluggable Authentication Modules) framework, which was developed to provide a flexible and standardized way to manage authentication services on Unix-like operating systems. Introduced as part of the initial PAM implementations, <I>pam_rootok</I> has served as a fundamental module ensuring that the root user can always authenticate under specific configurations, providing a crucial 'break glass in case of emergency' or convenience mechanism for system administrators.


title: SYNOPSIS
content:
This module is configured within PAM service files (e.g., <i>/etc/pam.d/login</i>) and is not executed directly from the command line.<br><br><b>Syntax in PAM configuration:</b><br><i>module_type control_flag pam_securetty.so [module_options]</i><br><br><b>Example:</b><br><i>auth required pam_securetty.so</i>


title: PARAMETERS
content:
<b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instructs the module to log debugging information via <i>syslog</i>.<br><br><b>no_warn</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses warnings if the <i>/etc/securetty</i> file is missing. By default, a warning is logged if the file is not found.<br><br><b>file=/path/to/securetty</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative path to the securetty file instead of the default <i>/etc/securetty</i>.<br><br>


title: DESCRIPTION
content:
<i>pam_securetty</i> is a Pluggable Authentication Module (PAM) that enhances system security by controlling where the root user can log in directly. It verifies that a login attempt by the root user originates from a terminal (TTY) device explicitly listed in the <i>/etc/securetty</i> file. This file contains a list of TTY devices considered 'secure' for root logins. If a root login is attempted from a TTY not present in this file, the module denies the authentication request. This mechanism helps prevent direct root access from potentially insecure terminals, such as network connections or dial-up lines, ensuring that administrative privileges are only granted via designated secure consoles or terminals. It is typically configured within PAM service files like <i>/etc/pam.d/login</i> or <i>/etc/pam.d/sshd</i>, usually in the <i>auth</i> stack.


title: CAVEATS
content:
<i>pam_securetty</i> primarily affects direct root logins. It does not control user switching to root via commands like <i>su</i>, unless <i>pam_securetty</i> is explicitly configured for the <i>su</i> PAM service.<br><br>The effectiveness of this module relies on the correct configuration and permissions of the <i>/etc/securetty</i> file. If the file is missing or empty, root logins might be unexpectedly denied or allowed.<br><br>For SSH access, <i>PermitRootLogin</i> option in <i>sshd_config</i> (e.g., set to <i>no</i> or <i>without-password</i>) often provides more comprehensive control over root logins than relying solely on <i>pam_securetty</i>.


title: SECURETTY FILE
content:
The <i>/etc/securetty</i> file is a plain text file where each line specifies a TTY device name (e.g., <i>tty1</i>, <i>console</i>, <i>pts/0</i>) from which the root user is permitted to log in directly. Only TTYs listed in this file are considered secure by <i>pam_securetty</i> for root authentication.


title: MODULE TYPE
content:
<i>pam_securetty</i> is typically used as an <b>auth</b> module in the PAM stack. This means it performs an authentication check, verifying the legitimacy of the login attempt based on the TTY from which it originates.


title: HISTORY
content:
The concept of restricting root logins to specific terminals (TTYs) existed in UNIX-like systems long before PAM. With the advent of Pluggable Authentication Modules (PAM) developed by Sun Microsystems and later adopted by Linux, this functionality was modularized into <i>pam_securetty</i>. This allowed administrators to flexibly integrate this security check into various authentication services without modifying the core programs, maintaining a critical layer of defense against unauthorized root access from untrusted terminals.


title: SYNOPSIS
content:
pam_selinux.so [debug] [relabel] [fs_create] [set_current] [restore_default_context] [strict] [nocon] [nohome] [noexec] [allow=<service_name>] [deny=<service_name>] [allow_unknown] [check_context] [select_context] [force_selection] [env=<variable>=<value>] [selinux_users_path=<path>]


title: PARAMETERS
content:
<b><b>debug</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose logging to syslog, which can be useful for troubleshooting SELinux context issues.<br><br><b><b>relabel</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instructs the module to attempt to relabel the user's home directory upon login if its current context is incorrect, based on SELinux policy defaults.<br><br><b><b>fs_create</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the user's home directory does not exist, this option allows the module to create it with the correct SELinux context and then relabel it if necessary. Often used with <i>pam_mkhomedir</i>.<br><br><b><b>set_current</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the current SELinux context of the process to the mapped user context after the session opens. This is typically the default behavior and is crucial for enforcing the user's SELinux domain.<br><br><b><b>restore_default_context</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Before exiting the session, attempts to restore the default SELinux context for the user's home directory. This can be used in conjunction with <i>pam_mkhomedir</i>.<br><br><b><b>strict</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If setting the SELinux context fails for any reason (e.g., no mapping found, permission denied), this option causes the PAM session to fail, preventing the user from logging in without the correct context.<br><br><b><b>nocon</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from setting a new SELinux context. It will still perform other operations like home directory relabeling or creation if specified.<br><br><b><b>nohome</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables any home directory management operations (creation or relabeling) by the module, even if <i>relabel</i> or <i>fs_create</i> are specified.<br><br><b><b>noexec</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from setting the <i>exec</i> context. This is typically used when the execution context should be inherited from the parent process or managed by another mechanism.<br><br><b><b>allow=&lt;service_name&gt;</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Allows SELinux context setting for the specified PAM service (e.g., 'ssh', 'login'). This option can be used multiple times to allow multiple services.<br><br><b><b>deny=&lt;service_name&gt;</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Denies SELinux context setting for the specified PAM service. This takes precedence over <i>allow</i> and can be used multiple times to deny multiple services.<br><br><b><b>allow_unknown</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Permits user login even if no corresponding SELinux user mapping is found for the system user. Without this option, such logins might fail if a mapping is expected.<br><br><b><b>check_context</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Verifies that the current process context matches the expected SELinux user context based on the user's mapping. If not, it can be used with <i>strict</i> to deny login.<br><br><b><b>select_context</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Allows the user to select their SELinux context from a list of authorized contexts. This typically requires the <i>pam_sepermit.so</i> module to be loaded in the PAM stack.<br><br><b><b>force_selection</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces context selection even if the <i>sepermit</i> module is not present or configured, potentially leading to unexpected behavior if not handled correctly by the PAM stack.<br><br><b><b>env=&lt;variable&gt;=&lt;value&gt;</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets an environment variable for the session. For example, <i>env=HOME=/new/home</i> could temporarily change the user's home directory variable.<br><br><b><b>selinux_users_path=&lt;path&gt;</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative directory path for the <i>seusers</i> file, overriding the default policy-specific path (e.g., <i>/etc/selinux/targeted/seusers</i>).<br><br>


title: DESCRIPTION
content:
The <i>pam_selinux</i> module is a Pluggable Authentication Module (PAM) designed to set the appropriate SELinux security context for a user's session upon login. It plays a crucial role in ensuring that users operate within their defined SELinux security boundaries.<br><br>When a user authenticates, <i>pam_selinux</i> consults the SELinux user mapping configuration (typically defined in <i>/etc/selinux/<policy_name>/seusers</i>) to determine the correct SELinux user, role, and type for the authenticated system user. Once determined, it sets the process's execution context, ensuring that subsequent actions within that session are constrained by the associated SELinux policy rules.<br><br>Beyond just setting the context, <i>pam_selinux</i> can also manage user home directories, including creating them if they don't exist and relabeling them to ensure they have the correct SELinux file contexts. This is vital for preventing security misconfigurations that could arise from incorrect labeling. It also offers options for debugging, strict enforcement, and conditional behavior based on the service initiating the session, making it a flexible component for integrating SELinux into system access controls.


title: CAVEATS
content:
The <i>pam_selinux</i> module relies heavily on a properly configured SELinux environment and policy. Incorrect or missing SELinux user mappings in <i>seusers(5)</i> can lead to unexpected denials or the inability for users to log in if <i>allow_unknown</i> is not used. When using options like <i>relabel</i> or <i>fs_create</i>, ensure that the system has sufficient permissions and that the underlying filesystem supports SELinux labeling. Conflicts can arise if other PAM modules perform similar actions (e.g., <i>pam_mkhomedir</i>) without proper coordination. The <i>select_context</i> option requires the <i>pam_sepermit.so</i> module to function correctly, and its absence or misconfiguration can prevent users from choosing their contexts.


title: MODULE TYPE
content:
<i>pam_selinux</i> is primarily configured as a <b>session</b> module in the PAM stack. This means it is invoked after successful authentication to establish and manage the user's SELinux context for the duration of their session. While it mostly affects the session phase, some of its options (like <i>strict</i> or <i>allow_unknown</i>) can indirectly influence the success of the authentication or account phases.


title: SELINUX USER MAPPING
content:
This module determines the SELinux context for a system user by consulting the <i>seusers</i> database (typically <i>/etc/selinux/<policy_name>/seusers</i>). This file maps Linux user identities (e.g., 'root', 'user') to SELinux user identities (e.g., 'unconfined_u', 'staff_u') and optionally specifies default roles and security levels (e.g., 'staff_u:s0-s0:c0.c1023'). The module then uses this mapping to call <i>setexeccon(3)</i> to set the user's default execution context, ensuring that the user's processes run with the appropriate SELinux security attributes.


title: HISTORY
content:
<i>pam_selinux</i> is an integral part of the SELinux userspace tools, which were developed to provide Mandatory Access Control (MAC) capabilities to Linux. Its development closely tracks the evolution of SELinux itself, aiming to seamlessly integrate SELinux context management into the standard PAM authentication and session management framework. It has been a core component for enforcing user-specific security contexts from the early days of SELinux adoption in major Linux distributions like Fedora and Red Hat Enterprise Linux.


title: SYNOPSIS
content:
In PAM configuration files (e.g., <I>/etc/pam.d/system-auth</I>), <b>pam_sepermit.so</b> is typically used as follows:<br><br><i>module-type</i> <i>control-flag</i> <b>pam_sepermit.so</b><br><br>Where <i>module-type</i> is usually <b>auth</b> or <b>account</b>, and <i>control-flag</i> specifies the module's behavior (e.g., <b>required</b>, <b>sufficient</b>, <b>optional</b>). The module itself takes no specific arguments.


title: DESCRIPTION
content:
<b>pam_sepermit</b> is a <I>Pluggable Authentication Module</I> (PAM) designed to enforce SELinux policy during user authentication and session establishment. Its core function is to verify if the Linux user attempting to log in has a <I>persistent</I> SELinux user mapping defined in the system's SELinux policy. This persistent mapping is typically configured using the <I>semanage login</I> command. If a user does not have an explicit persistent SELinux user mapping, or if the module cannot retrieve it, <I>pam_sepermit</I> can be configured to deny the authentication or account access, ensuring that all authenticated users operate within a predefined and managed SELinux security context. This module is crucial for environments requiring strict SELinux enforcement, preventing users from inadvertently or intentionally logging in with an unmanaged or default context that might bypass security policies.


title: CAVEATS
content:
<b>SELinux Dependency:</b> Requires SELinux to be enabled and in enforcing mode for its checks to be meaningful.<br><b>User Mapping Requirement:</b> Users must have explicit SELinux user mappings (e.g., configured via <I>semanage login</I>). Without proper mappings, users may be denied login.<br><b>Configuration Impact:</b> Misconfiguration, especially when using <B>required</B> control flags, can lead to users being locked out of the system.<br><b>No Context Setting:</b> This module <I>checks</I> for a persistent context; it does <I>not</I> set the SELinux context for the session. For setting the context, see <I>pam_selinux(8)</I>.


title: PAM STACK PLACEMENT
content:
The <I>pam_sepermit</I> module can be placed in different PAM module types:<br><b><I>auth</I> stack:</b> If placed here, it can deny authentication if the user's SELinux context is not persistent.<br><b><I>account</I> stack:</b> If placed here, it can deny access after successful authentication but before the session fully establishes, based on the persistent context check. This is often preferred as it allows for authentication failures to be handled separately.


title: SELINUX USER MAPPINGS
content:
For <I>pam_sepermit</I> to function correctly, SELinux users must be explicitly mapped to Linux users. This mapping is managed using the <I>semanage login</I> command. For example, to map a Linux user 'john' to an SELinux user 'user_u', one would use: <br><I>semanage login -a -s user_u -P john</I><br>The module checks against these persistent mappings to determine if a login is permitted.


title: DISTINCTION FROM PAM_SELINUX
content:
It's important to differentiate <I>pam_sepermit</I> from <I>pam_selinux</I>. While both are SELinux-related PAM modules:<br><b><I>pam_sepermit</I>:</b> <I>Checks</I> for a persistent SELinux user mapping. It enforces that a user has a predefined SELinux identity.<br><b><I>pam_selinux</I>:</b> <I>Sets</I> the SELinux context for the session. It transitions the process to the correct domain based on the user's mapping. These modules often work in conjunction but serve distinct purposes.


title: HISTORY
content:
The <I>pam_sepermit</I> module emerged as part of the broader SELinux ecosystem development, particularly to strengthen the security posture around user authentication and session management. Its introduction aimed to close potential gaps where users might log in without an explicitly defined SELinux user identity, thereby potentially operating outside of intended policy constraints. It became a standard component in distributions that extensively leverage SELinux for fine-grained access control.


title: SYNOPSIS
content:
Configured within PAM service files like `/etc/pam.d/login` or `/etc/pam.d/sshd`, the `pam_shells` module is declared as:<br><br><i>module_type</i> <i>control_flag</i> pam_shells.so [<i>options</i>]<br><br>Where:<br>- <i>module_type</i>: Specifies the management group (e.g., <b>auth</b>, <b>account</b>, <b>password</b>, <b>session</b>). For `pam_shells`, it is most commonly <b>auth</b>.<br>- <i>control_flag</i>: Determines the module's influence on the overall PAM stack's success or failure (e.g., <b>requisite</b>, <b>required</b>, <b>sufficient</b>, <b>optional</b>).


title: PARAMETERS
content:
<b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose logging of debugging information to system logs (syslog).<br><br><b>no_warn</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses warning messages that would normally be displayed to the user if their shell is deemed invalid.<br><br><b>file=<i>path</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative file to use as the list of valid shells, overriding the default `/etc/shells`.<br><br>


title: DESCRIPTION
content:
The `pam_shells` module is a core component of the Linux Pluggable Authentication Modules (PAM) framework. Its primary function is to enforce a security policy by ensuring that a user's login shell, as defined in their `/etc/passwd` entry, is listed in the `/etc/shells` file.<br><br>This module is typically configured in PAM service files (e.g., `/etc/pam.d/login`, `/etc/pam.d/sshd`) as an `auth` type module. When a user attempts to authenticate, `pam_shells` retrieves the user's shell from the system's user database and checks if it's present in the list of valid shells specified in `/etc/shells`. If the shell is not found in `/etc/shells`, the module typically returns a PAM_AUTH_ERR, leading to authentication failure.<br><br>This mechanism helps system administrators restrict users to a set of approved shells, preventing access with non-standard or potentially dangerous executables that might bypass system controls and enhance overall system security.


title: CAVEATS
content:
<ul><li>The `pam_shells` module only checks if the user's shell is <i>listed</i> in `/etc/shells`; it does <b>not</b> verify if the shell executable actually exists on the filesystem or if it is executable by the user.</li><li>Its effectiveness relies on the `/etc/shells` file being accurately maintained and containing only approved shell executables.</li><li>It should generally be used as an `auth` module with a `required` or `requisite` control flag to ensure the check is enforced before a user is granted access.</li></ul>


title: PAM CONFIGURATION EXAMPLE
content:
A typical configuration line for `pam_shells` in a PAM service file (e.g., `/etc/pam.d/login`) might look like:<br><br><b>auth required pam_shells.so</b><br><br>This ensures that the shell validation check is a mandatory step during the authentication process, preventing login if the user's shell is not in the allowed list.


title: /ETC/SHELLS FILE
content:
The `/etc/shells` file is a simple text file listing all valid login shells available on the system, with one shell path per line. This file is crucial for `pam_shells` to perform its validation. System administrators must ensure this file accurately reflects the approved shells to maintain system security and functionality, as any shell listed here is considered legitimate by the module.


title: HISTORY
content:
`pam_shells` is an integral part of the Linux-PAM (Pluggable Authentication Modules for Linux) project, which was developed to provide a flexible and standardized authentication mechanism for applications. The concept of using `/etc/shells` to validate user login shells predates PAM, but `pam_shells` formalized this check within the PAM framework, making it a modular and configurable security measure. Its development has mirrored the evolution of Linux-PAM itself, focusing on robustness and integration into various system services requiring user authentication. It remains a standard and recommended security practice for controlling user access based on approved shell environments.


title: SYNOPSIS
content:
<b>pam_systemd</b> is not a standalone command executed from the shell. Instead, it is a <I>PAM module</I> that is configured within PAM policy files, typically found in <I>/etc/pam.d/</I>. <br><br>Its typical usage within a PAM configuration file looks like this:<br><code><br>&nbsp;&nbsp;&nbsp;&nbsp;session&nbsp;&nbsp;optional&nbsp;&nbsp;pam_systemd.so<br></code><br>The <I><code>session</code></I> control flag indicates that this module should be invoked during the session management phase of authentication. The <I><code>optional</code></I> keyword means that the success or failure of this module does not determine the overall success of the PAM stack, but it's highly recommended for proper <i>systemd</i> integration.


title: PARAMETERS
content:
<b>None</b><br>&nbsp;&nbsp;&nbsp;&nbsp;According to the official manual pages (e.g., <code>man pam_systemd</code>), the <b>pam_systemd</b> module currently understands no module-specific options or parameters. Its functionality is activated solely by its presence in the PAM session stack.<br><br>


title: DESCRIPTION
content:
The <b>pam_systemd</b> module is a crucial component for modern Linux systems that use <i>systemd</i>. It integrates the traditional <I>PAM (Pluggable Authentication Modules)</I> login process with <i>systemd</i>'s advanced session management. When a user logs in through a PAM-enabled service (like SSH, graphical login, or a local console), <B>pam_systemd</B> ensures that a corresponding <i>systemd</i> user session is properly created and managed. <br><br>This module is responsible for starting the user's <i>systemd --user</i> instance if it's not already running, and for ensuring that the user's processes are correctly placed into the appropriate <i>cgroup</i> hierarchy. This enables <i>systemd</i> to effectively track, manage, and limit resources for all processes belonging to that user session. It also facilitates proper cleanup of user processes and resources when the session ends. Its presence is vital for applications that rely on <i>systemd</i>'s user manager, such as desktop environments, user services, and <code>loginctl</code>'s session tracking capabilities.


title: CAVEATS
content:
<ul><li><b>Dependency on systemd:</b> This module requires a running <i>systemd</i> init system and login manager (<I>systemd-logind.service</I>) to function correctly. Without it, user sessions may not be properly registered or managed.</li><li><b>PAM Stack Placement:</b> While typically placed as <code>session optional</code>, its position within the PAM session stack can subtly affect behavior, especially if other modules perform actions that rely on <i>systemd</i> session management.</li><li><b>Session Cleanup:</b> Proper operation of <b>pam_systemd</b> is crucial for robust user session cleanup. If sessions are not registered, processes might not be killed efficiently upon logout, leading to resource leaks.</li></ul>


title: USER CGROUP MANAGEMENT
content:
One of the primary functions of <b>pam_systemd</b> is to ensure that all processes spawned by a user during their session are placed into a dedicated <i>systemd</i> <i>cgroup</i> (control group) hierarchy. This allows <i>systemd</i> to monitor, account for, and manage the resources consumed by the entire user session, enhancing system stability and resource allocation efficiency. This integration is fundamental for the proper functioning of features like per-user resource limits and consistent process termination upon logout.


title: INTERACTION WITH LOGINCTL
content:
By registering user sessions with <i>systemd-logind</i> via <b>pam_systemd</b>, these sessions become visible and manageable through the <i>loginctl</i> command-line utility. Administrators can use <i>loginctl</i> to list active sessions, inspect their properties, terminate sessions, or even switch to different virtual terminals, demonstrating the tight integration between PAM logins and <i>systemd</i>'s session management capabilities.


title: HISTORY
content:
The <b>pam_systemd</b> module was developed as an integral part of the <i>systemd</i> project itself, which gained widespread adoption as the default init system for many Linux distributions starting in the early 2010s. It was introduced to seamlessly bridge the gap between traditional PAM-based authentication and <i>systemd</i>'s modern approach to user session management, CGroup integration, and resource control. Its development paralleled the growth of the <i>systemd --user</i> instance, becoming essential for providing a robust and consistent environment for user processes on <i>systemd</i>-driven systems.


title: SYNOPSIS
content:
<b>pam_tally2</b> [<i>-u</i> <username>] [<i>-r</i>] [<i>-l</i>] [<i>-f</i> <filename>] [<i>-h</i>] [<i>-V</i>]


title: PARAMETERS
content:
<b><i>-u</i> <username></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the username for which to display or reset the failed login tally. If omitted, the command typically lists tallies for all users with failed attempts (when combined with <i>-l</i> or default behavior).<br><br><b><i>-r</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reset the failed login count for the specified user (with <i>-u</i>) or for all users if <i>-u</i> is not provided. This action requires root privileges.<br><br><b><i>-l</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;List the tally for all users who have a non-zero failed login count. This provides an overview of accounts with recent failed login attempts.<br><br><b><i>-f</i> <filename></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify an alternative tally log file. By default, <b>pam_tally2</b> uses <i>/var/log/tallylog</i>.<br><br><b><i>-h</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display a short help message and exit.<br><br><b><i>-V</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display version information and exit.<br><br>


title: DESCRIPTION
content:
The <b>pam_tally2</b> command is a utility used in conjunction with the <i>pam_tally2.so</i> Pluggable Authentication Module (PAM). It allows system administrators to inspect and manage failed login attempt counters for user accounts. When configured within PAM, <i>pam_tally2.so</i> tracks consecutive failed authentication attempts and can be set to lock an account after a specified number of failures, thus mitigating brute-force attacks. The <b>pam_tally2</b> command provides the interface to view these tallies, or to reset them for a specific user or all users. This is crucial for unlocking accounts that have been temporarily locked due to excessive failed login attempts, or for auditing security incidents. While the command itself doesn't directly lock accounts, it manages the underlying counter that the PAM module uses to enforce security policies. It typically requires root privileges to operate.


title: CAVEATS
content:
The command <b>pam_tally</b> is largely deprecated in favor of <b>pam_tally2</b>, which offers improved robustness, especially regarding file locking and 64-bit support. <br>The actual account locking and unlocking based on failed attempts is performed by the <i>pam_tally2.so</i> PAM module, configured in files like <i>/etc/pam.d/system-auth</i>. The <b>pam_tally2</b> command only interacts with the persistent tally log file. <br>Resetting tallies (using <i>-r</i>) should be done carefully, as it can temporarily reduce security if an attacker is actively brute-forcing an account. Always ensure you understand the implications.


title: DEFAULT TALLY LOG LOCATION
content:
By default, <b>pam_tally2</b> reads and writes login attempt data to the file <i>/var/log/tallylog</i>. This file is critical for the <i>pam_tally2.so</i> module to maintain persistent counts across reboots and different login sessions.


title: INTERACTION WITH PAM
content:
The <b>pam_tally2</b> command doesn't directly enforce login policies. Instead, it serves as a management tool for the data file used by the <i>pam_tally2.so</i> module. The module itself, when configured in PAM service files (e.g., <i>/etc/pam.d/login</i>, <i>/etc/pam.d/sshd</i>), is responsible for incrementing the tally on failed attempts and denying access or locking accounts once a configured threshold is met. The command allows administrators to query the current state or reset the counters.


title: HISTORY
content:
The original <b>pam_tally</b> command and its corresponding <i>pam_tally.so</i> module were part of earlier PAM distributions. Over time, limitations and potential issues, particularly with file locking and handling of large tallies on 64-bit systems, led to its deprecation. <br>It was superseded by <b>pam_tally2</b> and <i>pam_tally2.so</i>, which address these issues by providing a more robust and secure mechanism for tracking failed login attempts. While <b>pam_tally</b> might still exist on some older systems, <b>pam_tally2</b> is the recommended and more commonly found utility on modern Linux distributions. More recently, <i>pam_faillock.so</i> and the <b>faillock</b> command have emerged as an even more flexible alternative, offering features like time-based resets and explicit administrative unlocks.


title: SYNOPSIS
content:
<b>pam_tally2</b> [<i>options</i>]<br>Common options include:<br><b>pam_tally2</b> [<b>-u</b> <i>user</i>] [<b>-r</b>] [<b>-f</b> <i>file</i>] [<b>-l</b>] [<b>-q</b>] [<b>--global-deny</b>] [<b>--help</b>] [<b>--version</b>]


title: PARAMETERS
content:
<b><b>-u</b> <i>&lt;username&gt;</i>, <b>--user</b> <i>&lt;username&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Selects the specific user whose tally should be displayed or reset. If omitted, information for all users will be shown.<br><br><b><b>-r</b>, <b>--reset</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Resets the tally count for the specified user (if <b>-u</b> is used) or for all users (if <b>-u</b> is omitted). Requires root privileges.<br><br><b><b>-f</b> <i>&lt;filename&gt;</i>, <b>--file</b> <i>&lt;filename&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative tally log file to use instead of the default (typically <i>/var/log/tallylog</i>).<br><br><b><b>-l</b>, <b>--last-failed-attempt-time</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the time of the last failed login attempt for each user in addition to the tally count.<br><br><b><b>-q</b>, <b>--quiet</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses output when used with the <b>-r</b> (reset) option, making the operation silent.<br><br><b><b>--global-deny</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays information related to system-wide denied access, if such a policy is configured by the <i>pam_tally2.so</i> module.<br><br><b><b>--help</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a brief usage message and exits.<br><br><b><b>--version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays version information for the command and exits.<br><br>


title: DESCRIPTION
content:
<i>pam_tally2</i> is a command-line utility used to inspect and manipulate the login attempt records managed by the <i>pam_tally2.so</i> Pluggable Authentication Module (PAM). This tool is essential for system administrators to manage account lockout policies, which are critical for preventing brute-force attacks against user accounts. It allows viewing the number of failed login attempts for individual users, resetting these counts, or inspecting global lockout statuses. The data is typically stored in a tally log file, commonly located at <i>/var/log/tallylog</i>. By interacting directly with this file, <i>pam_tally2</i> provides precise control over the accumulated failed login attempts, enabling administrators to unblock legitimate users who might have been locked out due to forgotten passwords or to review the status of accounts under potential attack. Its primary function is to provide a real-time view and control over the PAM-managed authentication failure statistics.


title: CAVEATS
content:
Using <i>pam_tally2</i> to reset tallies requires root privileges, as it modifies sensitive system files. Misuse can compromise account security by unblocking accounts that should remain locked out due to malicious activity. The effectiveness of <i>pam_tally2</i> relies entirely on the proper configuration and usage of the <i>pam_tally2.so</i> PAM module within the system's authentication stack. If the module is not active or configured incorrectly, <i>pam_tally2</i> may show no data or interact with an irrelevant file. The default tally log file path (<i>/var/log/tallylog</i>) can be overridden by PAM module configuration or the <b>-f</b> option, so always ensure you are inspecting the correct file.


title: TALLY FILE LOCATION
content:
The default tally log file managed by <i>pam_tally2</i> and its corresponding PAM module is usually located at <i>/var/log/tallylog</i>. This binary file stores the failed login attempt counts and the timestamp of the last attempt for each user.


title: INTERACTION WITH PAM MODULE
content:
<i>pam_tally2</i> works in conjunction with the <i>pam_tally2.so</i> PAM module. The module is responsible for incrementing the failed login counts and enforcing lockout policies based on configured thresholds. The <i>pam_tally2</i> command-line tool provides an interface for administrators to view and reset these counts manually.


title: SECURITY CONSIDERATIONS
content:
While <i>pam_tally2</i> is a vital tool for security, especially in managing account lockouts, it must be used with caution. Resetting tallies for a user can immediately unblock an account, which could be risky if the lockout was due to an ongoing brute-force attack. Always verify the reason for lockout before resetting.


title: HISTORY
content:
<i>pam_tally2</i> is the successor to the earlier <i>pam_tally</i> utility and module, designed to address some of its limitations, particularly in handling user IDs (UIDs) and potentially improving performance and reliability. It was developed as part of the broader PAM (Pluggable Authentication Modules) framework, which provides a flexible way to manage authentication services on Linux and other Unix-like systems. The evolution to <i>pam_tally2</i> focused on robustly supporting modern system environments and security requirements, aiming to provide a more scalable and reliable mechanism for tracking and managing failed login attempts, thereby enhancing system security against brute-force attacks.


title: SYNOPSIS
content:
Add to a PAM service configuration file (e.g., <I>/etc/pam.d/sshd</I>):<br><b>account required|requisite pam_time.so [debug] [no_warn] [deny|allow] [file=/path/to/time.conf] [field=DELIMITER]</b>


title: PARAMETERS
content:
<b><b>debug</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Logs verbose debugging information to syslog, which is highly useful for troubleshooting module behavior and understanding rule evaluation.<br><br><b><b>no_warn</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses warning messages generated by the module from being logged to syslog, resulting in cleaner log output.<br><br><b><b>deny</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;When specified, this module option sets the default behavior to <I>deny</I> access if no specific rules in the <I>time.conf</I> file match the current context. This option is mutually exclusive with <I>allow</I>.<br><br><b><b>allow</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;When specified, this module option sets the default behavior to <I>allow</I> access if no specific rules in the <I>time.conf</I> file match the current context. This is the default behavior if neither <I>deny</I> nor <I>allow</I> is provided. It is mutually exclusive with <I>deny</I>.<br><br><b><b>file=/path/to/time.conf</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Provides an alternative path to the module's configuration file, overriding the standard location of <I>/etc/security/time.conf</I>. This is useful for custom or service-specific configurations.<br><br><b><b>field=DELIMITER</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines a custom character to be used as a field separator within the configuration file rules, instead of the default semicolon (<I>;</I>). This allows for flexibility in rule file formatting.<br><br>


title: DESCRIPTION
content:
<b>pam_time</b> is a <I>PAM (Pluggable Authentication Modules)</I> module designed to enforce time-based access control for system services. It limits whether a user can access a particular service based on criteria such as the current time of day, the specific day of the week, and even the terminal (tty) from which the connection is initiated.<br><br>Operating at the <I>account</I> management stage of the PAM transaction, <b>pam_time</b> consults its configuration file, typically <I>/etc/security/time.conf</I>, for a set of predefined rules. These rules dictate when and under what circumstances access is allowed or denied. This module is an essential tool for system administrators seeking to implement granular time-of-use policies, for example, restricting network logins or shell access to specific working hours or preventing out-of-hours activity for certain user groups. Its flexible rule syntax allows for precise control over service availability.


title: CAVEATS
content:
<b>pam_time</b> functions exclusively within the PAM framework and is not a standalone command executed from the shell. Its effectiveness is entirely dependent on correct integration into PAM service files and the accuracy of the rules defined in <I>/etc/security/time.conf</I>.<br><br>Misconfiguration, particularly incorrect rule syntax or inappropriate default settings (e.g., <I>deny</I> without exhaustive rules), can lead to unintended access restrictions or even system lockouts for legitimate users. It strictly operates at the <I>account</I> management interface within the PAM stack and does not directly influence authentication credential verification or session management.


title: CONFIGURATION FILE (<I>/ETC/SECURITY/TIME.CONF</I>)
content:
The rules governing <b>pam_time</b> are typically defined in the <I>/etc/security/time.conf</I> file. Each rule must be on a single line and consists of four distinct fields, separated by semicolons (<I>;</I>) by default:<br>1. <I>services</I>: A comma-separated list of PAM service names (e.g., <I>login</I>, <I>sshd</I>). An asterisk (<I>*</I>) can be used to match all services.<br>2. <I>ttys</I>: A comma-separated list of terminal names or patterns (e.g., <I>console</I>, <I>tty*</I>). An asterisk (<I>*</I>) matches all terminals.<br>3. <I>users</I>: A comma-separated list of usernames or group names (prefixed with <I>%</I>). An asterisk (<I>*</I>) matches all users.<br>4. <I>times</I>: A string defining the allowed days and times.


title: RULE SYNTAX FOR <I>TIMES</I> FIELD
content:
The <I>times</I> field utilizes a specific, compact syntax for specifying allowed periods:<br>- Days of the week: Represented by two letters: <I>Mo</I>, <I>Tu</I>, <I>We</I>, <I>Th</I>, <I>Fr</I>, <I>Sa</I>, <I>Su</I>. Ranges (e.g., <I>Mo-Fr</I>) or single-letter abbreviations (e.g., <I>W</I> for weekdays, <I>A</I> for all days) are also supported.<br>- Time ranges: Indicated by four digits for start and end times (HHMM), separated by a hyphen (e.g., <I>0900-1700</I>). Times can wrap around midnight (e.g., <I>2300-0200</I>).<br><br>Example: The rule <I>sshd;*;john;Al0900-1700</I> would permit user 'john' to log in via SSH any day of the week between 9 AM and 5 PM.


title: PAM STACK INTEGRATION
content:
To activate <b>pam_time</b>'s functionality, it must be added to the <I>account</I> management interface section within the relevant PAM service configuration file (e.g., <I>/etc/pam.d/sshd</I> or <I>/etc/pam.d/login</I>).<br><br>A typical entry in a PAM service file might appear as:<br><I>account required pam_time.so</I><br><br>The strategic placement of this line within the PAM stack is critical. It should generally be placed before any other modules that might unconditionally allow access, ensuring that time restrictions are evaluated first.


title: HISTORY
content:
As a foundational <I>PAM</I> module, <b>pam_time</b> has been an integral component of the <I>Linux-PAM</I> project since its early development. Its inclusion addressed the critical need for flexible, system-level time-based access control, a common requirement in shared or enterprise computing environments. The module's design exemplifies the modular and extensible philosophy of the <I>PAM</I> architecture, allowing it to be seamlessly integrated into various system services without requiring modifications to the services themselves, thereby enhancing system security and administrative control.


title: SYNOPSIS
content:
The <b>pam_timestamp</b> module is not a standalone command but is configured within PAM service files, typically located in <i>/etc/pam.d/</i>.<br><br>Its typical usage in a PAM configuration file looks like this:<br><code>auth sufficient pam_timestamp.so [module options]</code><br><br>Where <code>auth</code> is the module interface type, <code>sufficient</code> is the control flag, and <code>pam_timestamp.so</code> is the module library.


title: PARAMETERS
content:
<b><b>debug</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Logs verbose debugging information to syslog.<br><br><b><b>verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Logs more information than default, but less than <i>debug</i>, to syslog.<br><br><b><b>timestamp_timeout=<i>N</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the timeout duration for the timestamp in minutes. The default is 5 minutes. If set to 0, the timestamp will never expire. A value of -1 makes the timestamp permanent, never expiring unless explicitly removed.<br><br><b><b>timestamp_type=<i>type</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies how timestamps are generated and stored. Possible values are: <i>tty</i> (default, one timestamp per terminal), <i>ppid</i> (one timestamp per parent process ID), or <i>user</i> (one timestamp per user, shared across all sessions/ttys).<br><br><b><b>timestamp_dir=<i>DIR</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the directory where timestamp files are stored. The default directory is usually <i>/var/run/sudo/ts</i>.<br><br><b><b>audit</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Logs all re-authentications (when a password is required due to an expired timestamp) to syslog.<br><br><b><b>nolog</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from logging authentication attempts to syslog. This can be useful to reduce log noise for very frequent operations.<br><br><b><b>disallow_null_tty</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If a TTY cannot be determined for the current session, this option will cause the module to return PAM_AUTH_ERR immediately, preventing authentication.<br><br><b><b>no_is_a_tty</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;By default, <b>pam_timestamp</b> expects the process to be attached to a TTY. This option disables that requirement, allowing the module to function in non-TTY environments.<br><br><b><b>service_name=<i>NAME</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Overrides the default PAM service name used when constructing the timestamp file path. This is useful for sharing timestamps between different services or for custom configurations.<br><br><b><b>module_name=<i>NAME</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Used primarily for debugging, this option sets the module name reported in syslog messages, making it easier to identify logs from this specific instance of the module.<br><br>


title: DESCRIPTION
content:
The <b>pam_timestamp</b> module is a Pluggable Authentication Module (PAM) component for Linux systems. Its primary purpose is to manage timestamp files that allow users to perform certain actions (like running <i>sudo</i> commands) without re-authenticating for a specified grace period. This significantly improves user convenience by reducing repetitive password prompts for frequent operations.<br><br>When a user successfully authenticates through a service configured with <b>pam_timestamp</b>, a timestamp file is created or updated. Subsequent attempts to use that service within the configured timeout period will check this timestamp file. If it's valid and unexpired, authentication can proceed without requiring the user to re-enter their password. If the timestamp has expired or is invalid, the user will be prompted for authentication again.<br><br>It is commonly used with the <i>sudo</i> command to implement its password caching behavior, where a user can execute multiple commands as root after authenticating just once. The module is configured within PAM service files, typically in the <i>auth</i> stack, for services like <i>sudo</i>.


title: CAVEATS
content:
<b>pam_timestamp</b> significantly improves convenience but introduces a potential security risk: if a terminal is left unlocked after an initial authentication, anyone with physical access can perform privileged actions within the grace period without re-entering the password.<br><br>The module relies on a properly configured PAM environment. Misconfiguration can lead to unexpected authentication behavior or deny legitimate access. It is not a standalone executable command; its functionality is solely within the PAM framework.


title: PAM CONFIGURATION
content:
To enable <b>pam_timestamp</b>, you need to edit the relevant PAM service file(s) in <i>/etc/pam.d/</i>. For example, to integrate it with <i>sudo</i>, you might add a line in <i>/etc/pam.d/sudo</i> within the <i>auth</i> stack, typically before the actual authentication module. The <code>sufficient</code> control flag is often used, meaning that if the timestamp is valid, PAM authentication is considered successful and no further <i>auth</i> modules are processed for that request. If the timestamp is invalid or expired, the module fails, and subsequent <i>auth</i> modules in the stack (e.g., <i>pam_unix.so</i>) are invoked to request a password.


title: TIMESTAMP FILE LOCATION AND NAMING
content:
By default, timestamp files are typically stored in <i>/var/run/sudo/ts/</i>. The exact filename depends on the <i>timestamp_type</i> option. For example, with <i>timestamp_type=tty</i>, files are named after the terminal's hash (e.g., <i>/var/run/sudo/ts/tty/0D9D7C2C92C3D3C9D5A2F2B4C3D3C3D3C9D3C3D3C9</i>). With <i>timestamp_type=user</i>, they are named after the user's UID (e.g., <i>/var/run/sudo/ts/user/1000</i>).


title: HISTORY
content:
The <b>pam_timestamp</b> module is part of the Linux-PAM project, a widely used implementation of Pluggable Authentication Modules. Its functionality directly addresses the common need for password caching, particularly relevant for tools like <i>sudo</i>, which historically implemented similar timeout mechanisms internally. <b>pam_timestamp</b> provides a standardized, modular way for any PAM-aware service to leverage this timestamp-based authentication grace period, promoting consistency and reusability across different applications.


title: PARAMETERS
content:
<b><b>-k</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Kill (remove) the timestamp file for the current user and tty. Useful for revoking a timestamp immediately.<br><br><b><b>-d</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Check if the timestamp directory (e.g., <i>/var/run/pam_timestamp/</i>) is present and has correct permissions. Exits non-zero if issues are found.<br><br><b><b>-u</b> <i>user</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the username for which to check or manipulate the timestamp. Defaults to the current effective user.<br><br><b><b>-t</b> <i>tty</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the TTY (terminal) for which to check or manipulate the timestamp. Defaults to the current TTY.<br><br><b><b>-s</b> <i>service</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the PAM service name associated with the timestamp. This helps isolate timestamps for different services.<br><br><b><b>-r</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Renew the timestamp, extending its validity period. This effectively acts as a fresh authentication for the timestamp mechanism.<br><br><b><b>-N</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Perform no timestamp check; always exit successfully (exit code 0). Useful for forcelly allowing access or testing.<br><br><b><b>-n</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Perform no timestamp check; always exit with failure (exit code 1). Useful for forcelly denying access or testing.<br><br><b><b>-h</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display a brief help message and exit.<br><br><b><b>-V</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display version information and exit.<br><br>


title: DESCRIPTION
content:
The <b>pam_timestamp_check</b> utility is a backend program primarily used in conjunction with the <b>pam_timestamp.so</b> PAM module. Its main purpose is to manage and verify authentication timestamp files, which are stored, typically, in <i>/var/run/pam_timestamp/</i>.<br><br>When a user successfully authenticates through a service configured with <b>pam_timestamp.so</b>, a timestamp file is created for that user and tty. Subsequent authentication attempts within a configured timeout period can then use this timestamp to allow access without requiring the user to re-enter their password, enhancing usability for operations like <b>sudo</b>. <b>pam_timestamp_check</b> can query these timestamps, remove them (e.g., when a session ends or explicitly by an administrator), or renew them. It's not typically run directly by end-users but invoked by PAM-aware applications or system scripts.


title: CAVEATS
content:
The timestamp mechanism, while convenient, introduces a potential security trade-off by extending authentication validity. Misconfiguration or reliance on insecure timestamp file locations can compromise system security. This utility relies heavily on the proper configuration of the <b>pam_timestamp.so</b> module in PAM service files. Timestamps are typically specific to a user and TTY, so activities on different terminals might require separate authentication.


title: TIMESTAMP FILE LOCATION
content:
Timestamp files are typically stored in <i>/var/run/pam_timestamp/</i>, although the specific path can be configured within the <b>pam_timestamp.so</b> module. Each file is named in a way that identifies the user, TTY, and optionally the service (e.g., <i>user_tty_service</i>) to which it applies. The directory and files must have appropriate permissions to prevent unauthorized access or manipulation, ensuring the integrity of the timestamp mechanism.


title: PURPOSE OF TIMESTAMPING
content:
The primary goal of the timestamp mechanism is to improve user experience and reduce friction for frequent privileged operations. Instead of constantly asking for a password for every sensitive command, PAM can consult the timestamp. If a valid, non-expired timestamp exists, it can bypass the password prompt, balancing security with convenience. This is especially useful in environments where users frequently execute commands requiring elevated privileges.


title: HISTORY
content:
<b>pam_timestamp_check</b> is an integral part of the Linux-PAM (Pluggable Authentication Modules for Linux) project, a robust framework for centralizing authentication services. It was developed to provide a flexible and configurable mechanism for session 'memory', allowing users to perform multiple privileged operations within a short period without repeated password prompts, similar to how <b>sudo</b>'s <i>timestamp_timeout</i> option functions. Its design emphasizes integration with the PAM framework, offering system administrators fine-grained control over authentication policies.


title: SYNOPSIS
content:
Add to PAM service files (e.g., <I>/etc/pam.d/sshd</I>):<br><I>session</I> <I>required</I> <B>pam_tty_audit.so</B> [<I>options</I>]


title: PARAMETERS
content:
<b>enable</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Explicitly enables TTY auditing for the session. This is often the default behavior if the module is active in the PAM configuration.<br><br><b>disable</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Explicitly disables TTY auditing for the session, overriding any global or default settings that might otherwise enable it.<br><br><b>log_dir=<I>path</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative directory where audit logs will be stored. The default location varies by system, but often defaults to <I>/var/log/tty_audit/</I> or integrates with <B>systemd-journald</B>.<br><br><b>action=<I>log|block</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines the module's behavior: <I>log</I> (default) records TTY activity; <I>block</I> prevents the session from starting if TTY auditing cannot be successfully initialized or performed.<br><br><b>audit_uid=<I>UID</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Limits auditing to sessions initiated by users with the specified numeric User ID (UID).<br><br><b>audit_gid=<I>GID</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Limits auditing to sessions initiated by users belonging to the specified numeric Group ID (GID).<br><br><b>audit_users=<I>user1,user2,...</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Audits only sessions for the comma-separated list of specified usernames.<br><br><b>exclude_users=<I>user1,user2,...</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Excludes the comma-separated list of specified usernames from TTY auditing.<br><br><b>audit_groups=<I>group1,group2,...</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Audits only sessions for users who are members of the comma-separated list of specified group names.<br><br><b>exclude_groups=<I>group1,group2,...</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Excludes users who are members of the comma-separated list of specified group names from TTY auditing.<br><br><b>term=<I>terminal_type</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Audits only sessions originating from a specific terminal type (e.g., <I>xterm</I>, <I>linux</I>, <I>vt100</I>).<br><br><b>ignore_term=<I>terminal_type</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Excludes sessions originating from the specified terminal type(s) from auditing.<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging output, which can be useful for troubleshooting issues with the <B>pam_tty_audit</B> module.<br><br><b>silent</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses informational messages and non-critical warnings generated by the module, preventing them from being displayed to the user or logged through standard channels.<br><br>


title: DESCRIPTION
content:
<B>pam_tty_audit</B> is a Pluggable Authentication Module (PAM) designed to record all input and output occurring on a user's terminal session. It operates by integrating into the PAM stack, typically invoked during the <I>session</I> phase of user authentication. When enabled, it captures every keystroke typed by the user and all text displayed on the screen, directing this information to a designated audit log file, often located in <I>/var/log/tty_audit.log</I> or managed by <B>systemd-journald</B>.<br><br>This module is primarily utilized for security auditing, regulatory compliance, and forensic analysis. It provides a granular level of monitoring, enabling administrators to track commands executed, data accessed, and general interactions within the terminal environment. Such detailed logging is invaluable for identifying suspicious activities, investigating security incidents, or reconstructing events post-compromise. Due to the extensive nature of the data captured, proper log rotation, archiving, and management strategies are crucial to prevent excessive disk space consumption.


title: CAVEATS
content:
Implementing <B>pam_tty_audit</B> introduces several considerations:<br><br><b>Performance Overhead:</b> Continuous logging of all terminal I/O can introduce a noticeable performance impact, especially on systems with high user concurrency or intensive terminal activity.<br><b>Storage Requirements:</b> Audit logs can grow rapidly to consume significant disk space. Robust log rotation and archiving policies are essential to manage storage.<br><b>Privacy Concerns:</b> This module captures all terminal input, including potentially sensitive information like passwords (if typed at a prompt within the session), private keys, or confidential data. Strict privacy policies and legal compliance must be considered.<br><b>Log Security:</b> The integrity and confidentiality of the generated audit logs are paramount. Logs must be secured against unauthorized access, modification, or deletion to maintain their evidentiary value.<br><b>Scope Limitation:</b> <B>pam_tty_audit</B> only records activity within pseudo-terminals (TTYs/PTYs), such as SSH sessions or local console logins. It does not monitor graphical user interface (GUI) applications or direct system calls not routed through a terminal.<br><b>Configuration Complexity:</b> Incorrect PAM configuration can lead to unforeseen issues, including preventing users from logging in. Careful testing is advised.


title: CONFIGURATION DETAILS
content:
<B>pam_tty_audit</B> is configured by adding a line to a PAM service file. Common files include <I>/etc/pam.d/sshd</I> for SSH logins, <I>/etc/pam.d/login</I> for direct console logins, or often within a centrally included file like <I>/etc/pam.d/system-auth</I>. The module typically belongs in the <I>session</I> stack.<br><br>Example line to enable auditing for the 'sysadmin' user, logging to a custom directory:<br><I>session required pam_tty_audit.so enable log_dir=/var/log/audit/tty audit_users=sysadmin</I>


title: LOG FILE FORMAT
content:
The audit logs generated by <B>pam_tty_audit</B> typically contain raw terminal I/O streams. The entries often include metadata such as timestamps, the user's UID/GID, the TTY device path, and then the actual data (raw keystrokes and screen output). This raw format usually requires specialized tools or scripts for effective parsing, searching, and analysis, making direct human readability challenging compared to more structured log formats.


title: HISTORY
content:
<B>pam_tty_audit</B> is a component of the <B>Linux-PAM</B> (Pluggable Authentication Modules) framework, which was first developed in the mid-1990s to provide a flexible and extensible authentication infrastructure for Unix-like systems. This specific module was introduced to address the growing need for detailed session auditing and monitoring, driven by security, compliance, and forensic requirements in enterprise and regulated environments. Its core functionality, focused on capturing raw terminal input and output, has remained consistent, evolving primarily with changes in PAM standards and logging practices (e.g., integration with <B>systemd-journald</B>).


title: SYNOPSIS
content:
<b>pam_umask.so</b> [<i>usergroups</i>] [<i>debug</i>] [<i>silent</i>] [<i>umask=0XXX</i>] [<i>login_defs</i>] [<i>none</i>]


title: PARAMETERS
content:
<b><i>usergroups</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If specified, the umask is set based on the <I>UMASK</I> value from <I>/etc/login.defs</I>. Specifically, if <I>USERGROUPS_ENAB</I> is 'yes' and the primary group name is the same as the username, the umask becomes <I>0002</I>; otherwise, the <I>UMASK</I> value from <I>login.defs</I> is used directly (typically <I>0022</I>).<br><br><b><i>debug</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging output, which is typically sent to <I>syslog</I> for diagnostic purposes.<br><br><b><i>silent</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses all informational and error messages that the module might otherwise emit, ensuring a quiet operation.<br><br><b><i>umask=0XXX</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Explicitly sets the umask to the octal value <I>0XXX</I> (e.g., <I>0022</I> for common file permissions, <I>0027</I> for stricter permissions). This option overrides any umask derived from <I>login.defs</I> or other sources.<br><br><b><i>login_defs</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;This is the default behavior if no <I>umask</I> or <I>usergroups</I> options are specified. The umask is read from the <I>UMASK</I> entry in <I>/etc/login.defs</I>. This option can be explicitly used for clarity.<br><br><b><i>none</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies that the <I>pam_umask</I> module should not set the umask at all for this particular PAM service line. This can be useful for selectively disabling its functionality.<br><br>


title: DESCRIPTION
content:
<I>pam_umask</I> is a <I>PAM (Pluggable Authentication Modules)</I> module designed to set the user's default file creation mask (<I>umask</I>) upon session initialization. This module ensures that newly created files and directories adhere to specified permission defaults, enhancing system security. It typically reads umask values from system-wide configuration files like <I>/etc/login.defs</I> (using the <I>UMASK</I> and <I>USERGROUPS_ENAB</I> variables) or can be configured with an explicit umask value directly in the PAM configuration. Integrated into the PAM stack, usually within the <I>session</I> type, <I>pam_umask</I> applies these settings before the user's shell or other applications start, providing a consistent and centrally managed umask policy across different login services such as SSH, console logins, and graphical desktop sessions.


title: CAVEATS
content:
The order of modules in the PAM stack is crucial; a later module or user shell startup scripts (e.g., <I>.bashrc</I>, <I>.profile</I>) can override the umask set by <I>pam_umask</I>. It is recommended to place <I>pam_umask.so</I> within the <I>session</I> PAM type. Proper configuration of <I>/etc/login.defs</I> (specifically <I>UMASK</I> and <I>USERGROUPS_ENAB</I>) is necessary for the module's default behavior.


title: CONFIGURATION
content:
<I>pam_umask</I> is configured by adding a line to a PAM service file in <I>/etc/pam.d/</I>, typically in the <I>session</I> section. For example: <I>session optional pam_umask.so</I> to use defaults, or <I>session required pam_umask.so umask=0027</I> to enforce a specific umask.


title: UMASK VALUE INTERPRETATION
content:
The umask value is a bit mask that specifies which permission bits are <B>removed</B> from the default file (<I>0666</I>) and directory (<I>0777</I>) permissions. <br>For example: <br>A umask of <I>0022</I> results in new files having permissions <I>0644</I> (rw-r--r--) and directories <I>0755</I> (rwxr-xr-x). <br>A umask of <I>0027</I> yields <I>0640</I> and <I>0750</I> respectively, providing more restrictive group and other permissions.


title: SOURCES OF UMASK
content:
The module attempts to determine the umask from several sources, prioritizing explicit settings: <br>1. An explicit <I>umask=0XXX</I> option specified in the PAM configuration line.<br>2. The <I>UMASK</I> and <I>USERGROUPS_ENAB</I> variables found in <I>/etc/login.defs</I>.<br>3. (Historically) A specific umask entry in the user's <I>/etc/passwd</I> GECOS field, though this method is less common or supported on modern systems.


title: HISTORY
content:
Part of the standard <I>Linux-PAM</I> suite, <I>pam_umask</I> has been a fundamental module for enforcing file creation permissions since the widespread adoption of PAM. It addresses the system administration need for a centralized, robust mechanism to manage default user umask settings, ensuring consistent security postures across different login services without relying solely on user-specific shell configurations.


title: SYNOPSIS
content:
<i>pam_unix</i> is not invoked as a standalone command but rather configured within PAM policy files, typically located in <i>/etc/pam.d/</i>. Its syntax within these files follows the PAM module standard:<br><br><i>module_type control_flag module_path [module_options]</i><br><br>A common entry for <i>pam_unix</i> would look like:<br><b><pre>auth     required     pam_unix.so try_first_pass</pre></b><br>Where:<br><i>module_type</i>: Specifies the interface (e.g., <b>auth</b>, <b>account</b>, <b>password</b>, <b>session</b>).<br><i>control_flag</i>: Determines the module's behavior relative to others (e.g., <b>required</b>, <b>requisite</b>, <b>sufficient</b>, <b>optional</b>).<br><i>module_path</i>: The path to the module library, usually <b>pam_unix.so</b>.<br><i>[module_options]</i>: Specific parameters to modify the module's behavior (see Parameters section).


title: PARAMETERS
content:
<b><b>nullok</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Allows users to authenticate with a null (empty) password. This is generally considered a security risk and should be used with extreme caution or avoided.<br><br><b><b>nodelay</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables the delay normally imposed after a failed authentication attempt. Removing the delay can make brute-force attacks slightly easier.<br><br><b><b>audit</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables logging of all authentication attempts, including successful and failed ones, to the system's audit logs. Useful for security monitoring.<br><br><b><b>shadow</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces <i>pam_unix</i> to consult the <i>/etc/shadow</i> file for password hashes. This is the default and recommended behavior on modern systems, but this option explicitly ensures it.<br><br><b><b>try_first_pass</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If a password has been obtained by a preceding module in the PAM stack, <i>pam_unix</i> will try that password first. If it fails, it will then prompt the user for a new password.<br><br><b><b>use_first_pass</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Similar to <i>try_first_pass</i>, but if the password from a preceding module fails, <i>pam_unix</i> will not prompt the user for a new password and will instead return an authentication failure immediately.<br><br><b><b>old_pass_was_used</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Primarily for the <b>password</b> module type. Indicates that the old password has already been verified by a previous module in the stack, so <i>pam_unix</i> should skip its own old password verification.<br><br><b><b>md5</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Historically used for enforcing MD5 password hashing. This option is largely obsolete on modern systems, which default to stronger hashing algorithms like SHA512.<br><br>


title: DESCRIPTION
content:
<i>pam_unix</i> is a fundamental <B>P</B>luggable <B>A</B>uthentication <B>M</B>odules (PAM) module on Linux systems. It is responsible for authenticating users against the traditional Unix password database, typically found in <i>/etc/passwd</i> and <i>/etc/shadow</i> files. When a service (like login, sudo, or sshd) requires authentication, it consults its PAM configuration file (e.g., <i>/etc/pam.d/login</i>). If <i>pam_unix.so</i> is listed, it will handle the process of prompting for a password and verifying it against the stored hash in <i>/etc/shadow</i>.<br><br>Beyond authentication, <i>pam_unix</i> also plays a role in account management (e.g., checking password expiration), password changes (updating the hash in <i>/etc/shadow</i>), and session management (though less prominent here compared to other modules). It acts as the backbone for traditional local user authentication, ensuring system security by managing access based on user credentials.


title: CAVEATS
content:
<i>pam_unix</i> is a core component of Linux authentication. Improper configuration of this module in PAM policy files can lead to severe security vulnerabilities (e.g., allowing empty passwords) or completely lock users out of the system. Always test PAM changes on a separate, non-critical system or with extreme caution. It relies heavily on the integrity and permissions of <i>/etc/passwd</i> and <i>/etc/shadow</i>.


title: PAM CONFIGURATION FILES
content:
PAM configuration for services is managed through individual files in the <i>/etc/pam.d/</i> directory. Each file (e.g., <i>/etc/pam.d/login</i>, <i>/etc/pam.d/sudo</i>) defines a stack of PAM modules and their behavior for that specific service. Understanding the order and control flags within these files is critical for correctly configuring <i>pam_unix</i> and the overall authentication flow.


title: PAM MODULE TYPES
content:
PAM modules operate across four distinct management groups or 'types':<br><b>auth</b>: Verifies the user's identity (e.g., password, biometrics) and sets credentials.<br><b>account</b>: Checks non-authentication related account management (e.g., password expiration, account validity, time restrictions).<br><b>password</b>: Handles password changes (e.g., prompting for old password, setting new password, enforcing complexity policies).<br><b>session</b>: Manages tasks performed before and after a user's service session (e.g., logging activity, mounting home directories).


title: HISTORY
content:
PAM (Pluggable Authentication Modules) was originally developed by Sun Microsystems in the mid-1990s as a flexible authentication framework. Linux adopted PAM in the late 1990s, with <i>pam_unix</i> becoming the cornerstone module for interfacing with the traditional Unix user and password databases. Its development has focused on maintaining compatibility with standard Unix authentication mechanisms while adapting to modern security practices, such as stronger password hashing algorithms and tighter integration with system logging.


title: SYNOPSIS
content:
<i>auth</i> <i>[control]</i> <b>pam_userdb.so</b> [<i>options</i>]<br><i>account</i> <i>[control]</i> <b>pam_userdb.so</b> [<i>options</i>]<br><i>password</i> <i>[control]</i> <b>pam_userdb.so</b> [<i>options</i>]


title: PARAMETERS
content:
<b>db=/path/to/file</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the absolute path to the Berkeley DB user database file. The default path is usually <i>/etc/security/userdb.db</i>.<br><br><b>crypt=<type></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the cryptographic hash algorithm to be used for storing and verifying passwords. Common types include <i>md5</i>, <i>sha256</i>, <i>sha512</i>, and <i>blowfish</i> (bcrypt). If not specified, the system default is used.<br><br><b>config_file=/path/to/file</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Points to a configuration file that contains additional parameters for the chosen cryptographic algorithm, such as the number of rounds for bcrypt (blowfish).<br><br><b>read_only</b><br>&nbsp;&nbsp;&nbsp;&nbsp;When present, this option prevents the module from making any modifications to the database file, especially when used with the <i>password</i> module type (e.g., for password changes).<br><br><b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging output, which can be useful for troubleshooting PAM configuration issues. Messages are typically logged to syslog.<br><br>


title: DESCRIPTION
content:
<i>pam_userdb.so</i> is a <I>PAM</I> (Pluggable Authentication Modules) module that provides authentication and account management services by querying a simple database file, typically a Berkeley DB file named <i>userdb.db</i>.<br><br>This module is particularly useful for managing specific sets of user accounts for particular services, allowing them to operate independently of the system's primary user databases like <i>/etc/passwd</i> or <i>/etc/shadow</i>. It retrieves username and hashed password pairs from the specified database to verify user credentials during login or other authentication processes.<br><br>While primarily focused on authentication, <i>pam_userdb.so</i> can also handle basic account management aspects, such as checking account validity or expiry, if supported by the database structure and module configuration. Its integration occurs within PAM configuration files (e.g., in <i>/etc/pam.d/</i>), where it is specified as an <i>auth</i> or <i>account</i> module. The database file itself needs to be pre-created and maintained using appropriate external database utilities from the Berkeley DB package.


title: CAVEATS
content:
The <i>userdb.db</i> file must be manually created and maintained using external Berkeley DB utilities like <i>db_load</i> or <i>db_dump</i>. It is not managed directly by standard user management commands like <i>useradd</i> or <i>passwd</i>.<br><br>Proper file permissions for the <i>userdb.db</i> file are critical for security; it should typically be owned by root and have restrictive permissions (e.g., 0600) to prevent unauthorized access.<br><br>This module is generally not recommended for large-scale user management; more robust solutions like LDAP or Kerberos are better suited for enterprise environments.<br><br>Password changes via the <i>pam_passwd</i> utility will only function if <i>pam_userdb.so</i> is configured as a <i>password</i> module type and the <i>read_only</i> option is <U>not</U> set.


title: DATABASE FILE FORMAT AND CREATION
content:
The <i>userdb.db</i> file is a Berkeley DB hash file. It's typically populated from a plain text file containing username:password_hash pairs, or sometimes username:password (if the <i>crypt</i> option is handled by the module), using the <i>db_load</i> utility.<br><br><b>Example for creating a database with a SHA512 hashed password:</b><br>1. Generate password hash: <I>openssl passwd -6 -salt $(head /dev/urandom | tr -dc A-Za-z0-9_.- | head -c 16) your_password_here</I><br>2. Create a temporary text file (e.g., <i>userdb.txt</i>):<br>   <I>your_username_here:your_sha512_hash_here</I><br>3. Load into DB: <I>db_load -T -t hash -f userdb.txt userdb.db</I><br>4. Set permissions: <I>chmod 600 userdb.db && chown root:root userdb.db</I><br>Ensure the <i>userdb.db</i> file is placed in a secure location, e.g., <i>/etc/security/</i>.


title: PAM MODULE TYPES AND INTEGRATION
content:
<i>pam_userdb.so</i> is commonly integrated into PAM configuration files (e.g., in <i>/etc/pam.d/system-auth</i> or a service-specific file like <i>/etc/pam.d/ftp</i>) using the <i>auth</i> and <i>account</i> module types:<br><br><b>Authentication:</b><br><I>auth sufficient pam_userdb.so db=/etc/security/userdb.db crypt=sha512</I><br><br><b>Account Management:</b><br><I>account sufficient pam_userdb.so db=/etc/security/userdb.db</I><br><br>The <i>control</i> flag (e.g., <i>sufficient</i>, <i>required</i>, <i>requisite</i>, <i>optional</i>) determines how the module's success or failure affects the overall PAM stack processing.


title: HISTORY
content:
<i>pam_userdb.so</i> is a component of the Linux-PAM project, which provides a flexible and modular approach to authentication services on Linux systems. It was developed to offer a simple, file-based alternative for user authentication, serving specific use cases where traditional system accounts or complex directory services are not required or desired. Its usage often involves specialized applications or environments needing an isolated, self-contained user database, making it a versatile tool for specific authentication challenges.


title: SYNOPSIS
content:
pam_wheel is configured within PAM service files (e.g., <I>/etc/pam.d/su</I>).<br><br>The module is typically invoked as part of an <I>auth</I> or <I>account</I> PAM stack:<br><br><I>module_type control_flag pam_wheel.so [options]</I><br><br><I>module_type</I>: Specifies the management group, e.g., <I>auth</I> (for authentication) or <I>account</I> (for account management).<br><I>control_flag</I>: Determines the module's influence on the overall authentication success/failure, e.g., <I>required</I>, <I>sufficient</I>, <I>optional</I>, <I>requisite</I>.<br><I>pam_wheel.so</I>: The shared library file for the module.


title: PARAMETERS
content:
<b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose logging to system logs for debugging purposes.<br><br><b>group=<I>name</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an alternative group to check instead of the default 'wheel' group. For example, <I>group=sudo_users</I>.<br><br><b>deny</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reverses the logic: grants access if the user is <B>not</B> in the specified group, and denies if they <B>are</B> in the group. Useful for preventing specific groups from accessing a service.<br><br><b>fail_safe</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the specified group does not exist, this option treats the user as if they are <B>not</B> a member of the group. Without this, a non-existent group may cause the module to fail.<br><br><b>trust</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the user is a member of the configured group, <I>pam_wheel</I> returns <I>PAM_SUCCESS</I> immediately, regardless of other conditions. This is usually used with <I>sufficient</I> control flag.<br><br><b>uidonly</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Checks only the effective UID (user ID) of the process against the group, ignoring the real UID. This is less common but can be relevant in specific privilege separation scenarios.<br><br><b>use_uid</b><br>&nbsp;&nbsp;&nbsp;&nbsp;When checking group membership, <I>pam_wheel</I> typically checks the real user ID (the user who invoked the service). With <I>use_uid</I>, it checks the target user's UID (the user identity that the service is trying to switch to), which is crucial for <I>su</I> where you're switching to a new user.<br><br>


title: DESCRIPTION
content:
pam_wheel is a <I>Pluggable Authentication Module (PAM)</I> that provides access control based on a user's membership in a specific group, traditionally the "wheel" group. It is not a standalone command but rather a shared library (<I>pam_wheel.so</I>) used within PAM configuration files (typically found in <I>/etc/pam.d/</I>).<br><br>When configured, pam_wheel checks if the authenticating user (or the target user if <I>use_uid</I> is specified, common for <I>su</I>) is a member of the designated group. Based on its configuration, it can either grant access (if the user is in the group) or deny access (if the user is not, or explicitly denied if <I>deny</I> option is used). It's commonly employed to restrict who can use commands like <I>su</I> to switch to the root user, ensuring only authorized administrators can gain elevated privileges. Its primary purpose is to add a layer of security by enforcing group-based access policies.


title: CAVEATS
content:
<b>Group Management</b>: Proper management of the "wheel" or specified group is paramount. Any user added to this group will gain the associated privileges.<br><b><I>sudo</I> vs. <I>su</I></b>: While <I>pam_wheel</I> is often used with <I>su</I>, many systems now prefer <I>sudo</I> for granular privilege control, as <I>sudo</I> allows specific commands to be run as root without full root access. <I>pam_wheel</I> only controls who can <I>become</I> root (or another user) via <I>su</I>.<br><b>PAM Stack Order</b>: The placement and <I>control_flag</I> of <I>pam_wheel.so</I> within the PAM configuration file are critical. An <I>optional</I> module will behave differently from a <I>required</I> or <I>sufficient</I> one.<br><b>Security Implications</b>: If misconfigured (e.g., using <I>deny</I> incorrectly, or granting too many users to the controlled group), it can weaken system security.


title: TYPICAL USE CASE: SU COMMAND
content:
The most common application of <I>pam_wheel</I> is to control access to the <I>su</I> command. A typical entry in <I>/etc/pam.d/su</I> might look like this: <I>auth required pam_wheel.so use_uid</I>. This configuration ensures that only users who are members of the <I>wheel</I> group (or the group specified by <I>group=</I> option) are allowed to switch to the root user or another user through the <I>su</I> command, provided no other PAM modules in the stack explicitly permit it.


title: HISTORY
content:
The concept of a "wheel" group originated in early versions of Unix, particularly BSD, as a way to restrict which users could use the <I>su</I> command to gain root privileges. Only users belonging to the "wheel" group were permitted to "spin the wheel" (i.e., gain root access). As Linux adopted PAM, <I>pam_wheel</I> was developed to provide this traditional access control mechanism within the flexible PAM framework. It continues to be a default part of the <I>su</I> PAM configuration on many Linux distributions, maintaining this historical security practice.


title: SYNOPSIS
content:
<i>auth</i> [<i>control_flag</i>] <b>pam_xauth.so</b> [<i>module_options</i>]<br><br>This module is configured within PAM service files (e.g., /etc/pam.d/su, /etc/pam.d/sudo) rather than being invoked directly from the command line.


title: PARAMETERS
content:
<b>debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging output to system logs, which can be helpful for troubleshooting.<br><br><b>xauth_path=/path/to/xauth</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the explicit path to the <b>xauth</b> utility. Useful if <b>xauth</b> is not in the default system PATH.<br><br><b>target_user=<i>user</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the username for which X authorization data should be prepared. This is crucial when switching identities (e.g., from root back to a regular user).<br><br><b>data_dir=/path/to/dir</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines a directory for temporary X authority data storage if needed by the module.<br><br><b>non_interactive</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents the module from prompting for a password if the target user is not specified or cannot be determined.<br><br><b>x_display</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Explicitly sets the X display name (e.g., ':0.0') for which authorization is managed, overriding the <b>DISPLAY</b> environment variable.<br><br><b>always</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the creation of new X authority entries, even if suitable ones already exist in the target user's session.<br><br><b>retain_parent_auth</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Copies the X authority entries from the parent session to the new session, even when a <b>target_user</b> is specified. This helps maintain X access across user switches.<br><br><b>clean</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Removes all existing X authority entries from the target session's <i>.Xauthority</i> file before adding new ones.<br><br><b>quiet</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses non-critical error messages, leading to less verbose logging.<br><br><b>use_first_available</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If multiple <i>.Xauthority</i> files are found, uses the first one encountered for input rather than trying to merge or select based on other criteria.<br><br><b>write_to_stdout</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Writes the generated X authority data to standard output instead of a file. This option is typically used in specific scripting scenarios rather than direct PAM configurations.<br><br>


title: DESCRIPTION
content:
<b>pam_xauth</b> is a Pluggable Authentication Module (PAM) designed to facilitate the proper handling of X authorization data, typically stored in a <i>.Xauthority</i> file, for user sessions. When a user changes identity (e.g., via <b>su</b> or <b>sudo</b>) or logs in, this module ensures that the new session has the necessary X authentication cookies to interact with an X server.<br><br>It primarily works by copying X authority entries from the parent session or creating new ones, allowing graphical applications to run without explicit <b>xauth</b> commands. This is crucial for maintaining a seamless graphical environment across session transitions, especially when dealing with X forwarding or shared display environments. It integrates with PAM configuration files to provide this service during authentication or session setup phases.


title: CAVEATS
content:
<b>Security Considerations</b>: Incorrect configuration of <b>pam_xauth</b> can potentially expose X sessions to unauthorized access. Always review permissions on <i>.Xauthority</i> files and module settings carefully.<br><br><b>Dependency</b>: This module requires the <b>xauth</b> utility to be installed and accessible on the system to function correctly.<br><br><b>Interaction with SSH</b>: When using <b>ssh -X</b> (X forwarding over SSH), SSH typically handles X authorization securely. In such cases, <b>pam_xauth</b> might be redundant or could potentially conflict if not carefully managed.<br><br><b>Environment Variables</b>: Proper functioning relies on the correct setting of <b>DISPLAY</b> and <b>XAUTHORITY</b> environment variables.


title: HISTORY
content:
<b>pam_xauth</b> emerged as part of the broader PAM (Pluggable Authentication Modules) framework, which was developed to modularize and centralize authentication services in Linux and Unix-like systems. Its creation was driven by the need to manage X server access seamlessly for users undergoing identity changes (e.g., via <b>su</b> or <b>sudo</b>), where default X authorization might not propagate correctly.<br><br>It addresses challenges related to X server security and the propagation of X cookies across different user contexts, becoming a standard component in systems requiring robust graphical session management since the early days of PAM's adoption.


title: SYNOPSIS
content:
<i>pamac</i> <b>[<i>global-options</i>]</b> <b><i>command</i></b> <b>[<i>command-options</i>]</b> <b>[<i>arguments</i>]</b><br><br><i>Examples:</i><br><i>pamac</i> <b>install</b> <i>firefox</i><br><i>pamac</i> <b>update</b><br><i>pamac</i> <b>search</b> <i>kde</i>


title: PARAMETERS
content:
<b><b>install</b> <i>&lt;package(s)&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Installs one or more specified packages from official repositories or the AUR.<br><br><b><b>remove</b> <i>&lt;package(s)&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Removes one or more specified packages, optionally including their dependencies.<br><br><b><b>update</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Synchronizes package databases and upgrades all outdated packages on the system.<br><br><b><b>search</b> <i>&lt;term(s)&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Searches for packages in official repositories and the Arch User Repository (AUR).<br><br><b><b>checkupdates</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Checks for available updates without performing the actual upgrade.<br><br><b><b>build</b> <i>&lt;package(s)&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Builds and installs specified packages from the Arch User Repository (AUR).<br><br><b><b>clean</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Cleans the package cache, removing old or uninstalled package files to free up disk space.<br><br><b><b>info</b> <i>&lt;package(s)&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays detailed information about specified packages.<br><br><b><b>list</b> <i>[options]</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Lists installed packages, offering various filtering and sorting options.<br><br><b><b>--version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the <i>pamac</i> program version information.<br><br>


title: DESCRIPTION
content:
<i>pamac</i> is a powerful and user-friendly package manager developed primarily for Manjaro Linux. It serves as a robust front-end to <b>pacman</b>, the default package manager for Arch Linux and its derivatives, offering a simplified and intuitive interface for managing software packages.<br><br>It seamlessly integrates support for official repositories, the Arch User Repository (AUR), Snap packages, and Flatpaks, providing a unified solution for software installation, removal, and updates. <i>pamac</i> is available as both a graphical user interface (GUI) application and a versatile command-line interface (CLI) tool. The CLI aims to simplify common <b>pacman</b> and AUR commands, providing a more consistent and easier-to-remember syntax, making package management accessible to users of all experience levels.


title: CAVEATS
content:
While <i>pamac</i> provides a user-friendly interface, it fundamentally operates on <b>pacman</b>'s backend. A basic understanding of <b>pacman</b> commands can be beneficial for advanced troubleshooting or specific package management scenarios.<br><br>Packages from the Arch User Repository (AUR) are community-maintained and not officially supported by Arch Linux. Exercise caution and review PKGBUILDs before building and installing AUR packages.


title: GUI APPLICATION
content:
In addition to its command-line interface, <i>pamac</i> is widely known and used for its intuitive graphical user interface (GUI), providing a visual way to browse, install, remove, and update software.


title: UNIFIED PACKAGE MANAGEMENT
content:
<i>pamac</i>'s strength lies in its ability to unify package management across various sources – official repositories, AUR, Snap, and Flatpak – all accessible through a single interface, simplifying software discovery and maintenance.


title: HISTORY
content:
<i>pamac</i> was developed by the Manjaro Linux project to provide a more accessible and graphical front-end to <b>pacman</b>, aiming to simplify package management for new users transitioning from other distributions. Its development has focused on ease of use, robust AUR integration, and later expanded to include comprehensive support for Snap and Flatpak packages, establishing itself as a central software management tool within the Manjaro ecosystem.


title: SYNOPSIS
content:
<b>pambackground</b> [<I>options</I>] <I>imagefile</I><br><b>pambackground</b> <I>-c color</I> <I>-p position</I> <I>-d</I> <I>imagefile</I>


title: PARAMETERS
content:
<b>-c <color></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the background color for areas not covered by the image. Color can be specified as '#RRGGBB' hexadecimal format.<br><br><b>-p <position></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies how the image should be positioned on the screen. Common values include 'center', 'tile', 'stretch', or precise pixel offsets like 'NNxNN', or percentage offsets like 'NN%xNN%'.<br><br><b>-d</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables dithering when rendering the image, potentially improving image quality by using more precise colors.<br><br><b><imagefile></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the image file to be used as a background. This file <i>must</i> be in a Netpbm (PPM, PGM, or PBM) format.<br><br>


title: DESCRIPTION
content:
<b>pambackground</b> is a utility designed to set a background image on the Linux console using the framebuffer device (typically <i>/dev/fb0</i>). It's commonly employed during the boot process or by display managers (like GDM, SDDM) to provide a visual backdrop before the full graphical environment loads, or for text-mode login screens. The command takes an image file in the Netpbm format (PPM, PGM, or PBM) as input. It can position the image (center, tile, stretch), set a background color for areas not covered by the image, and disable dithering for better image quality. Its primary purpose is to enhance the visual experience on the text console, making transitions smoother or providing branding. It does not affect graphical desktop environments once loaded.


title: CAVEATS
content:
<b>pambackground</b> requires a Linux console with <I>framebuffer support</I> enabled and active, typically accessible via <I>/dev/fb0</I>.<br>It needs appropriate permissions (often root privileges) to write to the framebuffer device.<br>The input image file <I>must</I> be in one of the <I>Netpbm</I> formats (PPM, PGM, or PBM). Other image formats are not supported directly.<br>This command operates on the <I>text console</I> and has no effect on graphical desktop environments once they are fully loaded.


title: IMAGE FORMAT REQUIREMENT
content:
Only <I>Netpbm</I> image formats (PPM, PGM, PBM) are supported. Converting other common formats (like JPEG, PNG) to Netpbm is necessary before use.


title: PERMISSIONS
content:
Running <I>pambackground</I> typically requires root privileges or membership in a group with write access to <I>/dev/fb0</I> to modify the framebuffer device.


title: TYPICAL USAGE
content:
This command is often invoked by display managers (e.g., GDM, SDDM) or by PAM modules during the system's boot process or user login, to set a temporary background on the console before a graphical session starts.


title: HISTORY
content:
<b>pambackground</b> is part of the <I>pam_misc</I> package, which provides miscellaneous PAM-related utilities. Its development is closely tied to the need for visual enhancements during the authentication and boot processes on Linux systems utilizing framebuffer consoles. It emerged as a simple, effective way to customize the console appearance before or during the start of a graphical session, or for purely text-based systems. It serves as a visual bridge, providing a consistent look and feel even before the desktop environment is fully initialized.


title: SYNOPSIS
content:
<i>pambrighten</i> [ <b>-luminosity</b> | <b>-rgb</b> | <b>-value</b> ] [ <b>-percentage</b> | <b>-factor</b> ] <i>brightness_value</i> [ <i>netpbm_file</i> ]


title: PARAMETERS
content:
<b><b>-luminosity</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies brightness adjustment based on the image's calculated luminosity, providing a more perceptually accurate adjustment.<br><br><b><b>-rgb</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies brightness adjustment by scaling the Red, Green, and Blue color components directly. This is the default mode.<br><br><b><b>-value</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies brightness adjustment based on the 'value' component of the HSV/HSL color model (i.e., the maximum of R, G, and B components).<br><br><b><b>-percentage</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Interprets the <i>brightness_value</i> as a percentage. For example, 200 means 200% brightness (2x original).<br><br><b><b>-factor</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Interprets the <i>brightness_value</i> as a direct multiplication factor. For example, 2.0 means 2 times the original brightness. This is the default mode.<br><br><b><i>brightness_value</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;A floating-point number representing the factor or percentage by which to adjust the image brightness.<br><br><b><i>netpbm_file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input Netpbm image file. If omitted, <i>pambrighten</i> reads image data from standard input.<br><br>


title: DESCRIPTION
content:
<i>pambrighten</i> is a command-line utility from the Netpbm suite used to adjust the brightness of various Netpbm image formats (PAM, PBM, PGM, PPM). It processes an input image, applying a specified brightness factor, and outputs the modified image. The adjustment factor determines the degree of change: a factor greater than 1.0 brightens, less than 1.0 darkens, and 1.0 leaves the image unaltered. The command offers different modes for applying this adjustment, such as <b>-rgb</b> (default, applies to each color component directly), <b>-luminosity</b> (adjusts based on perceived brightness), and <b>-value</b> (based on the maximum color component). This flexibility allows for nuanced control over the brightness modification. Designed for scripting and automated image processing workflows, <i>pambrighten</i> is a core tool within the Netpbm ecosystem, often piped with other utilities to create complex image manipulation sequences. It's particularly valued for its simplicity and efficiency in performing this fundamental image operation.


title: CAVEATS
content:
Care must be taken when using extreme <i>brightness_value</i> factors, as pixel values can be clipped to the maximum allowed value (e.g., 255 for 8-bit images), leading to loss of detail and saturation. The choice between <b>-luminosity</b>, <b>-rgb</b>, and <b>-value</b> modes significantly impacts the visual outcome, with <b>-luminosity</b> often yielding more natural-looking results for general photo adjustments.<br>The command only processes Netpbm formats; other image formats must be converted first using tools like <i>anytopnm</i>.


title: INPUT/OUTPUT
content:
By default, <i>pambrighten</i> reads a Netpbm image from standard input (<i>stdin</i>) and writes the modified image to standard output (<i>stdout</i>). This design enables seamless integration into shell pipelines, allowing for chaining multiple Netpbm operations. For example, <i>cat image.ppm | pambrighten 1.5 | pnmtopng > brighter.png</i> demonstrates a typical workflow, where a PPM image is brightened and then converted to PNG.


title: HISTORY
content:
<i>pambrighten</i> is an integral part of the Netpbm project, a comprehensive suite of graphics programs for converting, manipulating, and viewing image files. Netpbm itself evolved from the Pbmplus package in the early 1990s, with a focus on a modular, command-line tool philosophy. <i>pambrighten</i> embodies this design by providing a specific, well-defined function that can be easily combined with other Netpbm tools in shell scripts and automated workflows. Its development aligns with the continuous enhancement of the Netpbm suite to handle various image processing needs efficiently.


title: PARAMETERS
content:
<b>-blend</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Blends the foreground image into the background using its alpha channel (if present) or transparency.<br><br><b>-alpha</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the foreground's alpha channel for blending operations, interpreting foreground transparency.<br><br><b>-fill</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Fills transparent areas of the foreground image with a specified color, or black by default.<br><br><b>-bgfill</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Fills transparent areas of the background image (where foreground is transparent) with a specified color.<br><br><b>-x <x></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the X-coordinate (horizontal position) for the top-left corner of the foreground image relative to the background.<br><br><b>-y <y></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the Y-coordinate (vertical position) for the top-left corner of the foreground image relative to the background.<br><br><b>-n <n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Repeats the foreground image 'n' times within the composite area, effectively tiling it.<br><br><b>-w <width></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the width of the output composite image. The foreground image will be scaled or cropped accordingly.<br><br><b>-h <height></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the height of the output composite image. The foreground image will be scaled or cropped accordingly.<br><br><b>-min</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by taking the component-wise minimum of corresponding foreground and background pixel values.<br><br><b>-max</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by taking the component-wise maximum of corresponding foreground and background pixel values.<br><br><b>-mul</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by component-wise multiplication of foreground and background pixel values.<br><br><b>-add</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by component-wise addition of foreground and background pixel values.<br><br><b>-avg</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by component-wise averaging of foreground and background pixel values.<br><br><b>-sub</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by subtracting background pixel values from foreground pixel values (foreground - background).<br><br><b>-subb</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by subtracting foreground pixel values from background pixel values (background - foreground).<br><br><b>-div</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Composites by dividing foreground pixel values by background pixel values (foreground / background).<br><br><b>-test</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Generates a test image for debugging purposes, showing internal calculations and image regions.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages about the processing progress to standard error.<br><br><b>-color <R,G,B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a color using comma-separated RGB values (e.g., '255,0,0') for operations like <i>-fill</i>.<br><br><b>-backgroundcolor <R,G,B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a background color using RGB values for filling or background operations.<br><br><b>-opacity <float></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets a global opacity value (0.0 to 1.0) for the foreground image during blending.<br><br><b>-alphafile <alpha-image-file></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses an external image file as a dedicated alpha mask for the composite operation.<br><br><b>-alphaopacity <float></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies an opacity value (0.0 to 1.0) to the external alpha mask specified by <i>-alphafile</i>.<br><br><b>-clip</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Clips the foreground image to the dimensions of the background image.<br><br><b>-nocache</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables caching of image data, which can be useful for debugging or memory constrained systems.<br><br><b>-dump</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Dumps internal data structures to standard error for debugging purposes.<br><br><b>-debug</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debug output for troubleshooting command behavior.<br><br><b>-version</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints the Netpbm version information and exits.<br><br><b>foreground_file</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the foreground image file. If omitted, the foreground image is read from standard input.<br><br><b>background_file</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the background image file. If omitted, and a foreground file is specified, the background is read from standard input. If both file arguments are omitted, the foreground is from stdin and there is no background image (it's considered null).<br><br>


title: DESCRIPTION
content:
<i>pamcomp</i> is a versatile command-line utility from the Netpbm suite designed for compositing two images: a foreground image and a background image. It supports a wide array of operations, allowing users to blend, overlay, and combine images based on different mathematical or alpha blending modes. This makes it ideal for tasks such as superimposing logos, creating transparent overlays, or generating complex visual effects by manipulating image channels. The command can handle various Netpbm formats, including PPM, PGM, PBM, and especially PAM, which fully supports alpha channels for sophisticated transparency effects. It offers precise control over positioning, size, and blending parameters, making it a powerful tool for automated image processing workflows.


title: CAVEATS
content:
<i>pamcomp</i> is part of the Netpbm suite, which primarily handles its own image formats (PPM, PGM, PBM, PAM). While versatile, its direct integration with other image formats like JPEG or PNG requires piping through other Netpbm tools like <i>anytopnm</i> or <i>pamtopng</i>. For optimal results with transparency and alpha channels, the PAM format is highly recommended. Be mindful of arithmetic overflow/underflow when using mathematical composition modes (e.g., <i>-add</i>, <i>-sub</i>, <i>-div</i>), as pixel values are typically clamped to the valid range (0-maxval).


title: STANDARD INPUT/OUTPUT
content:
Unless specific input files are provided, <i>pamcomp</i> defaults to reading image data from standard input. The resulting composite image is always written to standard output, making it highly suitable for piping with other Netpbm utilities in complex image processing pipelines.


title: COLOR SPECIFICATION
content:
Colors for options like <i>-color</i> and <i>-backgroundcolor</i> are specified as comma-separated RGB triples (e.g., '255,0,0' for red). Each component should be an integer between 0 and 255, representing the intensity of red, green, and blue respectively.


title: HISTORY
content:
<i>pamcomp</i> is a modern replacement for the older <i>pnmcomp</i> command within the Netpbm project. It was introduced to leverage the capabilities of the PAM (Portable Arbitrary Map) format, which allows for images with arbitrary numbers of channels, including a dedicated alpha channel. This evolution enabled <i>pamcomp</i> to handle true transparency and more sophisticated composite operations compared to its predecessor, which was limited to traditional RGB (PPM) or grayscale (PGM) images without native alpha support. Its development aligns with Netpbm's goal of providing a robust, modular, and scriptable toolkit for image manipulation.


title: PARAMETERS
content:
<b>-v, --verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display detailed analysis steps and verbose output during the configuration scan.<br><br><b>-d, --dry-run</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Parse and display the PAM configuration paths and loaded modules without performing deep security checks. Useful for quickly inspecting what files are being considered.<br><br><b>-s <I>LEVEL</I>, --severity=<I>LEVEL</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Filter the output to show only issues with a severity level equal to or higher than the specified <I>LEVEL</I> (e.g., 'high', 'medium', 'low').<br><br><b>-r <I>FORMAT</I>, --report=<I>FORMAT</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the output format for the generated report. Supported formats include 'text', 'json', and 'html'.<br><br><b><I>PAM_SERVICE</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;An optional argument specifying the particular PAM service to analyze (e.g., 'sshd', 'login', 'sudo'). If omitted, <b>pamcrater</b> would typically scan all commonly configured PAM services.<br><br>


title: DESCRIPTION
content:
The <b>pamcrater</b> command is a hypothetical diagnostic utility designed to analyze Pluggable Authentication Modules (PAM) configurations on a Linux system. Its primary purpose is to identify potential weaknesses, misconfigurations, or security loopholes within PAM service definitions that could lead to unauthorized access, privilege escalation, or system instability. The name 'crater' implies its function to detect flaws that could 'crater' (severely damage) system security.<br><br>It operates by parsing PAM configuration files, checking module order, verifying file permissions, and simulating common attack vectors or bypass attempts. <b>pamcrater</b> does not modify any system files or actively exploit vulnerabilities; instead, it generates a comprehensive report detailing identified issues, their severity levels, and often provides recommendations for remediation. This tool would be invaluable for system administrators, security auditors, and developers aiming to harden their system's authentication infrastructure.


title: CAVEATS
content:
<b>pamcrater</b> would typically require root privileges to access and correctly interpret all PAM configuration files and system-level permissions. It might produce false positives due to the complexity of PAM interactions and system-specific configurations. The tool is designed for diagnostic purposes only and does not automatically fix identified issues; manual intervention based on the report is required. Running it on a heavily loaded system or with complex PAM configurations could be resource-intensive.


title: CONFIGURATION PATHS
content:
<b>pamcrater</b> primarily analyzes files located in the <I>/etc/pam.d/</I> directory, where individual PAM service configuration files reside. It would also consult the master PAM configuration in <I>/etc/pam.conf</I> if it exists, and possibly other system-wide security settings that influence PAM behavior.


title: SEVERITY LEVELS AND REPORTING
content:
The report generated by <b>pamcrater</b> categorizes findings into different severity levels: <I>High</I> (critical issues potentially leading to immediate compromise), <I>Medium</I> (significant weaknesses that could be exploited), and <I>Low</I> (minor issues, best practices violations, or informational warnings). Each entry would include the affected PAM service, the specific vulnerability or misconfiguration identified, and suggested remediation steps.


title: HISTORY
content:
The conceptual <b>pamcrater</b> command emerged from the need for proactive security auditing of PAM configurations, which are notoriously complex and a frequent source of vulnerabilities when misconfigured. It was hypothetically developed by a consortium of open-source security researchers in the late 2010s, aiming to automate checks that were previously performed manually. Initial versions focused on common pitfalls like 'nullok' without sufficient controls or improper module stacking. Over time, it conceptually evolved to incorporate more sophisticated analysis techniques, including permission checks and module interaction logic, becoming an essential (albeit fictional) part of a system administrator's security toolkit.


title: PARAMETERS
content:
<b>-left <i>X</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the X-coordinate of the left edge of the cut region. The top-left pixel is (0,0).<br><br><b>-top <i>Y</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the Y-coordinate of the top edge of the cut region. The top-left pixel is (0,0).<br><br><b>-width <i>W</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the width of the cut region in pixels.<br><br><b>-height <i>H</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the height of the cut region in pixels.<br><br><b>-right <i>R</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the X-coordinate of the right edge of the cut region. Used as an alternative to <i>-width</i>.<br><br><b>-bottom <i>B</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the Y-coordinate of the bottom edge of the cut region. Used as an alternative to <i>-height</i>.<br><br><b>-xy <i>X Y W H</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;A convenient shorthand for specifying <i>-left</i>, <i>-top</i>, <i>-width</i>, and <i>-height</i> simultaneously.<br><br><b>-pad</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the specified cut region extends beyond the image boundaries, pad the output with pixels. By default, padding is black.<br><br><b>-force</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses warnings if the cut region extends outside the image boundaries. Useful when combined with <i>-pad</i>.<br><br><b>-fill=<i>color</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the color to use for padding when <i>-pad</i> is active. <i>color</i> can be a color name (e.g., 'red') or hexadecimal RGB (e.g., '#FF0000').<br><br><b>-l <i>X</i>, -t <i>Y</i>, -w <i>W</i>, -h <i>H</i>, -r <i>R</i>, -b <i>B</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Shorthand options for <i>-left</i>, <i>-top</i>, <i>-width</i>, <i>-height</i>, <i>-right</i>, and <i>-bottom</i> respectively.<br><br>


title: DESCRIPTION
content:
pamcut is a fundamental utility within the <b>Netpbm</b> suite, designed for extracting a specified rectangular sub-region (a 'cut') from an input image or image stream. It supports all <b>Netpbm</b> formats, including PAM, PGM, PPM, and PBM. Users define the desired region by providing its top-left corner coordinates and either its width and height, or its bottom-right corner coordinates. This versatility makes <i>pamcut</i> ideal for tasks such as cropping images, generating thumbnails, or isolating specific graphic elements for subsequent processing. The command offers robust handling for cuts that extend beyond the original image boundaries, with options to pad these areas using a specified color. <i>pamcut</i>'s ability to read from standard input and write to standard output makes it highly adaptable for use in command-line pipelines.


title: CAVEATS
content:
The coordinate system for <i>pamcut</i> is standard: the top-left corner of the image is (0,0). Coordinates increase to the right (X) and down (Y). If a cut region extends beyond the source image's bounds and the <i>-pad</i> option is not used, <i>pamcut</i> will typically issue a warning and clip the output to the valid image area. Using <i>-pad</i> will fill the extended area, by default with black, or with a specified fill color using <i>-fill=color</i>. Ensure input files are in a <b>Netpbm</b> format (PAM, PBM, PGM, PPM).


title: STANDARD I/O USAGE
content:
<i>pamcut</i> is designed to work seamlessly with Unix pipelines. If no input file is specified, it reads image data from standard input (stdin). The resulting cut image is always written to standard output (stdout), allowing it to be easily piped to other <b>Netpbm</b> utilities or redirected to a file.


title: DEFAULT BEHAVIOR
content:
If only <i>-left</i> and <i>-top</i> are specified without explicit width/height or right/bottom parameters, <i>pamcut</i> will attempt to cut from the specified top-left coordinate to the end of the image. It is generally best practice to explicitly define the region (e.g., with <i>-width</i> and <i>-height</i>) to avoid unexpected truncation or behavior.


title: HISTORY
content:
<i>pamcut</i> is a member of the extensive <b>Netpbm</b> package, a collection of graphics programs designed for image manipulation. <b>Netpbm</b> originated in the late 1980s/early 1990s as <i>pbmplus</i>. The <i>pam</i> commands, including <i>pamcut</i>, were introduced as part of the <b>Netpbm</b> project to support the more general PAM (Portable Arbitrary Map) format, which unified and extended the older PBM, PGM, and PPM formats. <i>pamcut</i> effectively supersedes the older <i>pnmcut</i>, offering broader input format compatibility and more robust features for image region extraction.


title: SYNOPSIS
content:
<b>pamdeinterlace</b> [<b>-odd</b> | <b>-even</b> | <b>-half</b>] [<b>-interp</b> [<b>-interleave_option</b>=<I>METHOD</I>]] [<b>-top</b> | <b>-bottom</b>] [<b>-topbottom</b> | <b>-bottomtop</b>] [<b>-pair</b>] [<b>-interleave</b> | <b>-interleavefirst</b> | <b>-interleavesecond</b>] [<b>-verbose</b>] [<I>pamfile</I>]


title: PARAMETERS
content:
<b><b>-odd</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Output only the odd-numbered scanlines. The resulting image will be half the height of the input.</I><br><br><b><b>-even</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Output only the even-numbered scanlines. The resulting image will be half the height of the input.</I><br><br><b><b>-half</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>A synonym for <b>-odd</b>.</I><br><br><b><b>-interp</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Deinterlaces the image by interpolating the missing lines to restore the original height. This creates a progressively scanned image from interlaced fields. This is mutually exclusive with <b>-odd</b>, <b>-even</b>, <b>-half</b>, <b>-pair</b>, and <b>-interleave</b>.</I><br><br><b><b>-interleave_option</b>=<I>METHOD</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Specifies the interpolation method to use with <b>-interp</b>. Common methods include "blend" (default), "duplicate", "average", "linear", "top", "bottom", "mean", and "median".</I><br><br><b><b>-top</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Assumes the top field of the interlaced image is composed of the odd scanlines (default behavior).</I><br><br><b><b>-bottom</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Assumes the bottom field of the interlaced image is composed of the odd scanlines.</I><br><br><b><b>-topbottom</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Outputs two fields stacked vertically, with the top field (odd scanlines by default) above the bottom field (even scanlines by default).</I><br><br><b><b>-bottomtop</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Outputs two fields stacked vertically, with the bottom field (even scanlines by default) above the top field (odd scanlines by default).</I><br><br><b><b>-pair</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Writes two separate PAM files to standard output, one for each field. This requires the output to be redirected to a file, and a second file will be created with a ".1" suffix.</I><br><br><b><b>-interleave</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Combines the two fields into a full-height image by interleaving them. By default, it starts with the first field. This is mutually exclusive with <b>-interp</b>, <b>-odd</b>, <b>-even</b>, <b>-half</b>, and <b>-pair</b>.</I><br><br><b><b>-interleavefirst</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>A synonym for <b>-interleave</b>.</I><br><br><b><b>-interleavesecond</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Combines the two fields into a full-height image by interleaving them, starting with the second field.</I><br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>Prints informational messages about the processing to standard error.</I><br><br><b><I>pamfile</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<I>The input PAM or PGM file. If omitted, <b>pamdeinterlace</b> reads from standard input.</I><br><br>


title: DESCRIPTION
content:
<I><b>pamdeinterlace</b> is a Netpbm command-line utility designed to process interlaced images, typically derived from video sources. It operates on PAM (Portable Arbitrary Map) or PGM (Portable Graymap) formatted images, reading from standard input and writing to standard output. The primary function is to deinterlace an image by separating its odd and even scanlines, which represent the two interlaced fields of a video frame.<br><br>It can output a single field (reducing height by half), or it can reconstruct a full-height, progressively scanned image by interpolating the missing lines. Various interpolation methods are available, such as blending, averaging, or duplicating adjacent lines, to achieve different visual qualities for the deinterlaced output. It also offers options to re-interleave fields in various orders or extract fields as separate images. This tool is fundamental for preparing video frames for progressive display or further processing where interlacing artifacts need to be removed.</I>


title: CAVEATS
content:
<I>The command assumes a specific interlacing pattern (e.g., odd lines form one field, even lines form another). If the source material uses a different or more complex interlacing scheme (e.g., progressive scan within fields, pulldown), <b>pamdeinterlace</b> might not produce optimal results.<br>When using <b>-pair</b>, the output is two files, which might not be compatible with standard piping mechanisms to other Netpbm tools that expect a single output.<br>Interpolation methods vary in quality. Simple methods like "duplicate" can cause comb artifacts, while more complex methods like "linear" or "blend" provide smoother transitions but can blur details.</I>


title: <I>TYPICAL USE CASE</I>
content:
<I>A common usage involves piping an image, possibly extracted from video, into <b>pamdeinterlace</b> with the <b>-interp</b> option to create a visually deinterlaced image for progressive display. For example, <br><code>ffmpeg -i video.mp4 -vf select='eq(n,100)' -vframes 1 output.ppm | pamdeinterlace -interp -interleave_option=blend > deinterlaced_frame.ppm</code><br> would extract frame 100, then deinterlace it using blending.</I>


title: <I>FIELD ORDER</I>
content:
<I>Understanding the field order (which field is odd or even, top or bottom) is crucial for correct deinterlacing. Video standards (like NTSC or PAL) often define a specific field dominance. If the default <b>-top</b> assumption is incorrect for your source, you may need to use <b>-bottom</b> to avoid artifacts.</I>


title: HISTORY
content:
<I><b>pamdeinterlace</b> is part of the Netpbm project, a long-standing open-source suite of graphics programs for converting and manipulating images. Netpbm itself originated from Jef Poskanzer's Pbmplus package in the late 1980s. <b>pamdeinterlace</b> specifically was written by Bryan Henderson, the current maintainer of Netpbm, and added to the suite to address the common need for deinterlacing video frames processed as images.</I>


title: SYNOPSIS
content:
pamdepth [-depth N] [-maxval M] [-dither | -nodither] [-floyd | -nofloyd] [-red | -green | -blue | -black] [-verbose] [pamfile]


title: PARAMETERS
content:
<b><b>-depth N</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the new depth of the output image. <b>N</b> specifies the number of samples per tuple (e.g., 1 for grayscale, 3 for RGB).<br><br><b><b>-maxval M</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the new maximum sample value for each component in the output image. <b>M</b> must be greater than or equal to 1. This effectively controls the bit depth (e.g., <b>maxval 255</b> is 8-bit).<br><br><b><b>-dither</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables dithering when the <b>maxval</b> is reduced, improving visual quality by dispersing quantization errors. Floyd-Steinberg is the default dithering algorithm.<br><br><b><b>-nodither</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables dithering, resulting in a direct truncation of sample values if <b>maxval</b> is reduced.<br><br><b><b>-floyd</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Explicitly enables Floyd-Steinberg dithering. This is the default dithering algorithm when <b>maxval</b> is reduced and dithering is enabled.<br><br><b><b>-nofloyd</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Same as <b>-nodither</b>; disables Floyd-Steinberg dithering.<br><br><b><b>-red</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Converts the image to grayscale (depth 1) using only the red component of the input image.<br><br><b><b>-green</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Converts the image to grayscale (depth 1) using only the green component of the input image.<br><br><b><b>-blue</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Converts the image to grayscale (depth 1) using only the blue component of the input image.<br><br><b><b>-black</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Converts the image to a solid black image (depth 1).<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages about the conversion process to standard error.<br><br><b><b>[pamfile]</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input PAM image file. If omitted, pamdepth reads from standard input.<br><br>


title: DESCRIPTION
content:
pamdepth is a utility from the Netpbm toolkit, designed to modify the characteristics of a Portable Arbitrary Map (PAM) image. It precisely adjusts the <i>depth</i> (number of samples per pixel, e.g., 1 for grayscale, 3 for RGB, 4 for RGBA) and the <i>maxval</i> (maximum sample value for each component, e.g., 255 for 8-bit color).<br><br>Its primary use cases include reducing file size by lowering <i>maxval</i> (e.g., converting 16-bit to 8-bit), preparing images for displays with limited color depths, or converting color images to grayscale. When reducing <i>maxval</i>, pamdepth can employ dithering techniques, particularly Floyd-Steinberg dithering (which is the default when reduction occurs), to minimize quantization errors and preserve visual detail by distributing errors across neighboring pixels. The command reads the PAM image from standard input or a specified file and writes the modified image to standard output. It also offers specific options to extract individual color channels or create a black image, effectively changing the image's depth to 1.


title: CAVEATS
content:
<i>Loss of Information</i>: When reducing the <b>maxval</b> or <b>depth</b> of an image, pamdepth inherently involves a loss of information. While dithering can mitigate visible artifacts, the original data cannot be fully recovered.<br><br><i>Performance with Dithering</i>: Dithering operations, especially on large images, can be computationally intensive and may take longer than simple truncation.<br><br><i>Output Format</i>: The output is always a PAM image. If other formats are required, a subsequent Netpbm conversion tool (e.g., <b>pamtoppm</b>) must be used.


title: INPUT/OUTPUT BEHAVIOR
content:
pamdepth is designed to work as a filter in a Unix pipeline. It reads the input image from standard input (<i>stdin</i>) by default, or from a specified file path. The resulting modified image is then written to standard output (<i>stdout</i>). This allows for chaining multiple Netpbm commands together for complex image manipulation tasks. For example, <b>cat image.png | pngtopam | pamdepth -maxval 15 | pamtopng > output.png</b>.


title: HISTORY
content:
pamdepth is a part of the Netpbm package, a venerable suite of graphics utilities dating back to the late 1980s/early 1990s. Initially, Netpbm focused on PBM (Portable Bitmap), PGM (Portable Graymap), and PPM (Portable Pixmap) formats.<br><br>The PAM (Portable Arbitrary Map) format and associated tools like pamdepth were introduced later (around the early 2000s) to provide a more flexible and extensible format that could handle arbitrary depths, alpha channels, and other image characteristics not easily represented by the older PNM formats. pamdepth superseded the more limited <b>pnmdepth</b> by offering greater control over both maxval and depth, and by supporting the more modern PAM format which Netpbm tools now predominantly use for internal processing. Its development reflects the ongoing evolution of image processing needs, moving towards more flexible and robust ways to manipulate pixel data.


title: SYNOPSIS
content:
pamdice {-width=<<i>width</i>> -height=<<i>height</i>> | -rows=<<i>rows</i>> -cols=<<i>cols</i>>} [-xcoord=<<i>x</i>>] [-ycoord=<<i>y</i>>] [-outfileprefix=<<i>prefix</i>>] [-nullpad | -nonullpad] [-autoborder] [-verbose] [<i>pamfile</i>]


title: PARAMETERS
content:
<b>-width=<<i>width</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>Mandatory (with -height).</b> Specifies the width of each diced image tile in pixels.<br><br><b>-height=<<i>height</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>Mandatory (with -width).</b> Specifies the height of each diced image tile in pixels.<br><br><b>-rows=<<i>rows</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>Mandatory (with -cols).</b> Specifies the number of rows (vertical cuts) to make. Mutually exclusive with <i>-width/-height</i>.<br><br><b>-cols=<<i>cols</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>Mandatory (with -rows).</b> Specifies the number of columns (horizontal cuts) to make. Mutually exclusive with <i>-width/-height</i>.<br><br><b>-xcoord=<<i>x</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the X-coordinate (horizontal) of the top-left corner of the first output image. Default is 0.<br><br><b>-ycoord=<<i>y</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the Y-coordinate (vertical) of the top-left corner of the first output image. Default is 0.<br><br><b>-outfileprefix=<<i>prefix</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a prefix for the output filenames. The default is 'dice'.<br><br><b>-nullpad</b><br>&nbsp;&nbsp;&nbsp;&nbsp;If image dimensions are not exact multiples of tile dimensions, output smaller tiles for the remainder. Mutually exclusive with <i>-nonullpad</i>.<br><br><b>-nonullpad</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Default) If image dimensions are not exact multiples, output tiles are padded with black to the specified size. Mutually exclusive with <i>-nullpad</i>.<br><br><b>-autoborder</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Finds a common border around each tile to use as a cut point, rather than exact pixel dimensions. Useful for scanned images with margins.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Provides verbose output about the processing steps.<br><br><b><i>pamfile</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input image file. If omitted, <i>pamdice</i> reads from standard input.<br><br>


title: DESCRIPTION
content:
<i>pamdice</i> is a Netpbm program that divides a single PAM or PNM image into a grid of smaller images. You specify the dimensions of the smaller images (width, height) or the number of rows and columns for the grid. The command outputs these smaller images, typically named with a sequential numeric suffix, to individual files. This is particularly useful for tasks such as preparing image sprites for web development, breaking down large scanned documents into individual pages, or segmenting satellite imagery for further processing.<br><br>It supports various input formats readable by Netpbm and outputs in the PAM format by default, which can then be converted to other formats using other Netpbm tools like <i>pamtopng</i> or <i>pamtojpeg</i>. <i>pamdice</i> can automatically calculate the number of output images based on the input image's size and the specified tile dimensions, handling any leftover pixels by either padding or discarding them, depending on the options used.


title: CAVEATS
content:
<i>pamdice</i> works best with PAM or PNM format images. While it can read other formats via Netpbm's automatic conversion, performance is optimal with native formats.<br><br>The <i>-autoborder</i> option relies on finding a consistent border, which may not work effectively on all types of images, especially those without clear, uniform margins.<br><br>Using <i>-nullpad</i> can result in output images of varying sizes, which might require additional processing or careful handling by subsequent applications.


title: INPUT/OUTPUT
content:
<i>pamdice</i> reads a single PAM/PNM image from a file or standard input. It writes multiple PAM images to files, named using the specified prefix and a sequential number (e.g., <i>dice0001.pam</i>, <i>dice0002.pam</i>).


title: DIMENSION SPECIFICATION
content:
You must specify either <i>-width</i> and <i>-height</i> (for fixed tile dimensions) or <i>-rows</i> and <i>-cols</i> (for a fixed number of divisions). You cannot mix these two approaches.


title: HISTORY
content:
<i>pamdice</i> is part of the Netpbm project, a toolkit for graphic file format conversion and image manipulation. Netpbm has a long history, originating from the <i>pbmplus</i> package created by Jef Poskanzer in the late 1980s. <i>pamdice</i> itself was introduced as part of the transition to the PAM (Portable Arbitrary Map) format, which generalized the existing PBM (Portable BitMap), PGM (Portable GrayMap), and PPM (Portable PixMap) formats. Its development reflects the ongoing need for efficient command-line image processing tools that can be chained together in shell scripts.


title: PARAMETERS
content:
<b>-floyd</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the <B>Floyd-Steinberg</B> dithering algorithm. This is the default if no other algorithm is specified, known for its good detail preservation.<br><br><b>-riemersma</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the <B>Riemersma</B> dot diffusion dithering algorithm, which produces a distinctive patterned look.<br><br><b>-fsriemersma</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Employs a hybrid <B>Floyd-Steinberg/Riemersma</B> dithering algorithm, combining aspects of both methods.<br><br><b>-threshold</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies simple thresholding (no dithering). Pixels brighter than 50% gray become white, darker become black, resulting in a stark conversion.<br><br><b>-serpentine</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Traverses the image in a serpentine (back-and-forth) manner for some algorithms. This can help reduce visual artifacts like banding.<br><br><b>-norandom</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables the minor random component added by default to some dithering algorithms, which can sometimes reduce subtle patterns at the cost of slightly increased artifact visibility.<br><br><b>-gamma</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies gamma correction to the input image before dithering. This is useful for accurately representing luminance on displays with non-linear gamma responses.<br><br><b>-random</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Introduces a substantial random component into the error distribution during dithering. This can make images look less patterned but potentially noisier.<br><br><b>-seed=<I>N</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the seed for the random number generator used by options that include randomness, ensuring reproducible results for development or testing.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informational messages to standard error about the processing steps, useful for debugging or understanding the command's operation.<br><br><b><I>pam_file</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input PAM or PGM file. If omitted, <I>pamditherbw</I> reads the image data from standard input.<br><br>


title: DESCRIPTION
content:
<i>pamditherbw</i> is a utility from the <B>Netpbm</B> suite that converts a grayscale image (PAM or PGM) into a black and white (PBM) image using various dithering algorithms.<br><br>Dithering is a technique used to create the illusion of color depth in images with a limited color palette (here, just black and white) by scattering pixels of different colors. This command is crucial for displaying grayscale images on monochrome displays or for preparing images for printing on black and white printers, where smooth gradients need to be simulated without actual shades of gray. Different dithering methods can produce distinct visual results, affecting the perceived detail and noise in the output.


title: CAVEATS
content:
Only one dithering algorithm (e.g., <B>-floyd</B>, <B>-riemersma</B>, <B>-threshold</B>) can be selected at a time. If multiple are specified, the last one on the command line takes precedence.<br>Input must be in <B>PAM</B> or <B>PGM</B> format; other image formats are not directly supported. Output is always <B>PBM</B>.


title: INPUT/OUTPUT FORMATS
content:
<i>pamditherbw</i> strictly adheres to the <B>Netpbm</B> ecosystem's format conventions. It expects a <B>PAM</B> or <B>PGM</B> (Portable Graymap) image as its input. Regardless of the input format, the command always produces a <B>PBM</B> (Portable Bitmap) image as its output. This design enables seamless piping with other <B>Netpbm</B> utilities.


title: DITHERING QUALITY AND ALGORITHMS
content:
The choice of dithering algorithm profoundly influences the visual quality of the resulting black and white image. <B>Floyd-Steinberg</B> is widely preferred for its ability to preserve fine details and smooth gradients by diffusing errors to neighboring pixels, minimizing banding. <B>Riemersma</B> offers an alternative with a more distinct 'dot' pattern. In contrast, simple <B>thresholding</B> provides the fastest conversion but often results in a harsh, blocky appearance, as it makes no attempt to simulate shades of gray.


title: HISTORY
content:
<i>pamditherbw</i> is a key component of the <B>Netpbm</B> project, an extensive open-source graphics utility toolkit. The <B>Netpbm</B> suite originated from <B>PBMPlus</B>, a package created by Jef Poskanzer in the late 1980s. <B>Netpbm</B> tools, including <i>pamditherbw</i>, are designed for manipulating graphic files using simple, consistent portable formats and stream-based processing. Its evolution includes the addition of support for the more flexible <B>PAM</B> (Portable Arbitrary Map) format, alongside the traditional <B>PGM</B> (Portable Graymap) format.


title: SYNOPSIS
content:
<i>pamedge</i> [-sobel|-prewitt|-roberts|-laplacian|-simple|-none] [-horiz|-vert|-diag|-all|-none] [-width=<I>N</I>] [-height=<I>N</I>] [-maxval=<I>N</I>] [-verbose] [<I>netpbmfile</I>]


title: PARAMETERS
content:
<b>-sobel</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the Sobel 3x3 edge detection mask, emphasizing stronger edges.<br><br><b>-prewitt</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the Prewitt 3x3 edge detection mask, similar to Sobel but simpler.<br><br><b>-roberts</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the Roberts cross 2x2 edge detection mask, good for fast detection.<br><br><b>-laplacian</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses the Laplacian 3x3 edge detection mask, useful for second derivative analysis.<br><br><b>-simple</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses a basic 3x3 edge detection mask.<br><br><b>-none</b><br>&nbsp;&nbsp;&nbsp;&nbsp;When used for mask selection, means no edge detection is performed. When used for direction, means no specific direction is emphasized.<br><br><b>-horiz</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Emphasizes horizontal edges in the output image.<br><br><b>-vert</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Emphasizes vertical edges in the output image.<br><br><b>-diag</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Emphasizes diagonal edges in the output image.<br><br><b>-all</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Emphasizes all directional edges. This is often the default behavior if no specific direction is chosen.<br><br><b>-width=<I>N</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the width of the output image to <I>N</I> pixels.<br><br><b>-height=<I>N</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the height of the output image to <I>N</I> pixels.<br><br><b>-maxval=<I>N</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the maximum pixel value (color depth) of the output image to <I>N</I>. By default, it uses the input image's maxval.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints detailed information about the processing steps and image characteristics to standard error.<br><br><b><I>netpbmfile</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input Netpbm format image file. If omitted, <i>pamedge</i> reads from standard input.<br><br>


title: DESCRIPTION
content:
<i>pamedge</i> is a command-line utility from the <b>Netpbm</b> toolkit designed to detect and highlight edges within an image. It primarily operates on <B>PAM</B> (Portable Arbitrary Map) format images but can also process other Netpbm formats such as <B>PBM</B> (bitmap), <B>PGM</B> (grayscale), and <B>PPM</B> (color) by converting them internally. The command uses various edge detection algorithms, including Sobel, Prewitt, Roberts, and Laplacian, to identify abrupt changes in pixel intensity that typically indicate edges. It reads image data from standard input or a specified file and writes the resulting edge-enhanced image to standard output, adhering to the Netpbm philosophy of chained image processing. This tool is valuable for tasks like feature extraction, image analysis, and preparing images for further graphical manipulation.


title: CAVEATS
content:
<i>pamedge</i> is primarily designed for grayscale images. While it accepts color (PPM) and bitmap (PBM) inputs, it typically converts them to grayscale internally for edge detection, or processes color components separately. The output maxval might be larger than the input maxval if not explicitly controlled with <i>-maxval</i>, potentially requiring further normalization with other Netpbm tools.


title: STANDARD I/O USAGE
content:
Following the Unix philosophy, <i>pamedge</i> operates as a filter. It reads image data from standard input if no file argument is provided, and writes the processed image to standard output. This design makes it highly suitable for chaining with other Netpbm commands in pipelines, enabling complex image manipulation workflows.


title: IMAGE FORMAT CONVERSION
content:
While primarily focused on the PAM format, <i>pamedge</i> intelligently handles other Netpbm image types (PBM, PGM, PPM). It performs internal conversions to an appropriate format for edge detection and outputs the result in a compatible Netpbm format, typically PGM or PAM, depending on the input and processing.


title: HISTORY
content:
<i>pamedge</i> is an integral part of the <b>Netpbm</b> project, a suite of graphics utilities that evolved from the PBMplus package. Netpbm has a long history in Unix and Linux environments, providing fundamental image processing capabilities. <i>pamedge</i> was developed to specifically handle the more flexible <B>PAM</B> format, extending the existing edge detection functionality within the toolkit and ensuring compatibility with the modern Netpbm suite's unified arbitrary map format.


title: PARAMETERS
content:
<b>factor</b><br>&nbsp;&nbsp;&nbsp;&nbsp;An integer representing the enlargement multiplier. Each pixel in the input image will be replicated into a block of <i>factor</i> x <i>factor</i> identical pixels in the output. Must be a positive integer.<br><br><b>pnmfile</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input Netpbm image file. If omitted, <b>pamenlarge</b> reads image data from standard input.<br><br>


title: DESCRIPTION
content:
<b>pamenlarge</b> is a specialized command-line utility from the <b>Netpbm</b> image processing toolkit. Its primary function is to enlarge a Netpbm image (any format: PBM, PGM, PPM, or PAM) by a specified integer factor. The enlargement is performed using a simple pixel replication method: each pixel in the original image is replaced by a block of <i>factor</i> x <i>factor</i> identical pixels in the output image. For instance, if you enlarge an image by a factor of 3, every single pixel becomes a 3x3 block of that same pixel's color.<br><br>This method is very fast and computationally inexpensive, making it suitable for quick previews or for cases where the blocky appearance is acceptable or even desired (e.g., pixel art). The command reads the input image from a file specified as an argument, or from standard input if no file is given. The resulting enlarged image is written to standard output. While effective for integer scaling, users should be aware that this technique does not interpolate pixels, leading to a "pixelated" or "blocky" appearance rather than a smooth, interpolated enlargement. For smoother scaling or non-integer factors, other Netpbm tools like <b>pamscale</b> are more appropriate.


title: CAVEATS
content:
<b>pamenlarge</b> uses a basic pixel replication algorithm for enlargement. This means that each pixel in the original image is simply duplicated to create a larger block of the same color. Consequently, the output image will appear "blocky" or "pixelated," especially when enlarged by a significant factor, as no interpolation or smoothing is performed. This method is not suitable for achieving smooth, high-quality enlargements typically expected for photographs or intricate graphics. For such purposes, a more sophisticated scaling algorithm like those provided by <b>pamscale</b> (which can perform interpolation) or other image manipulation tools (e.g., ImageMagick) should be used.


title: SIMPLICITY AND PERFORMANCE
content:
<b>pamenlarge</b> embodies the <b>Netpbm</b> philosophy of providing simple, fast tools for fundamental image manipulations. Its pixel replication method is computationally very inexpensive, making it extremely fast even on large images or older hardware. This simplicity also means it has very few options, making it easy to learn and integrate into shell scripts and pipelines, often chaining it with other <b>Netpbm</b> utilities like <b>pnmtojpeg</b> or <b>pamtopng</b> for format conversion after enlargement.


title: HISTORY
content:
<b>pamenlarge</b> is a core utility within the <b>Netpbm</b> image processing package. Netpbm itself originated from the <b>pbmplus</b> package, which was developed in the late 1980s and early 1990s. The design philosophy of Netpbm tools, including <b>pamenlarge</b>, emphasizes simplicity, efficiency, and adherence to the Unix philosophy of doing "one thing well." <b>pamenlarge</b> was designed as a straightforward tool for integer-factor image enlargement, providing a basic but fast method suitable for its specific niche, particularly for pixel art or scenarios where a "blocky" aesthetic is acceptable. Its continued presence highlights the enduring utility of simple, robust command-line tools for image manipulation.


title: SYNOPSIS
content:
<b>pamexec</b> [<i>options</i>] [<i>PAM_service_name</i>] [<i>target_user</i>] <i>command</i> [<i>command_arguments...</i>]


title: PARAMETERS
content:
<b>-t <i>target_user</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the target user for the command to be executed. If not specified, the command runs as the user established by PAM or the current user.<br><br><b>-u <i>current_user</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>(Deprecated)</i> Sets the current user. Use the `PAM_USER` environment variable instead.<br><br><b>-e <i>VAR=VAL</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adds or overwrites an environment variable for the executed command. Can be specified multiple times.<br><br><b>-f</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_FD` environment variable, indicating a file descriptor to be used by the command.<br><br><b>-s</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_SERVICE` environment variable based on the PAM service name.<br><br><b>-d</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Dumps the environment variables that would be passed to the executed command to stderr. Useful for debugging.<br><br><b>-l</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Logs the environment variables to syslog (AUTH facility, INFO priority).<br><br><b>-v</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, printing additional diagnostic messages to stderr.<br><br><b>-q</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables quiet mode, suppressing all output except errors.<br><br><b>-h</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message and exits.<br><br><b>-V</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays version information and exits.<br><br><b>-n</b><br>&nbsp;&nbsp;&nbsp;&nbsp;No-op mode. Performs a dry run without actually executing the command. Useful for testing environment setup.<br><br><b>-r</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Causes <b>pamexec</b> to return the exit status of the executed command. By default, it always returns 0 unless there's an internal error.<br><br><b>-c <i>config_file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reads additional configuration from the specified file. Typically used for environment variables.<br><br><b>-i <i>input_file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Redirects the standard input of the executed command from `input_file`.<br><br><b>-o <i>output_file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Redirects the standard output of the executed command to `output_file`.<br><br><b>-E</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Preserves the existing environment variables, rather than starting with a clean environment. Newly set variables take precedence.<br><br><b>-P</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Processes arguments of the form `key=value` as environment variables for the command.<br><br><b>-X</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_XAUTHTOKEN` environment variable, typically related to X Window System authentication.<br><br><b>-Z</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_SELINUX_CONTEXT` environment variable, used in SELinux environments.<br><br><b>-R</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_REMOTE_HOST` environment variable, indicating the remote host from which the session originated.<br><br><b>-T</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the `PAM_TTY` environment variable, indicating the terminal associated with the session.<br><br>


title: DESCRIPTION
content:
The <b>pamexec</b> command is a specialized utility program primarily designed to be invoked by PAM (Pluggable Authentication Modules) services, particularly through the <i>pam_exec.so</i> module. Its core function is to execute an external command under specific environmental conditions and user contexts determined by PAM. <br><br>It allows the PAM module to perform actions such as setting up a user's environment, running session-specific scripts, or logging events, all while potentially changing the effective user ID and manipulating environment variables. This makes it a powerful tool for system administrators to integrate custom scripts or programs into the authentication and session management flow, ensuring that these actions are performed with the correct privileges and within the PAM-defined context. It is not typically invoked directly by end-users but rather as part of the system's authentication and authorization process.


title: CAVEATS
content:
Incorrect usage of <b>pamexec</b>, particularly when invoked from PAM configuration files, can lead to security vulnerabilities or system instability. Care should be taken to ensure that commands executed by <b>pamexec</b> are secure, do not introduce unintended side effects, and are run with the principle of least privilege. Environment variable manipulation can be complex, and unexpected interactions might occur if not carefully managed. Always test changes to PAM configurations in a controlled environment.


title: PRIMARY USE CASE
content:
While <b>pamexec</b> can theoretically be run directly, its primary and intended use is as an external command invoked by the <i>pam_exec.so</i> PAM module within `pam.d` configuration files (e.g., `/etc/pam.d/login`, `/etc/pam.d/sshd`). This allows system administrators to run custom scripts or programs at various stages of the PAM authentication, account, session, or password management process, such as setting up a user's home directory after first login, logging session starts, or enforcing custom policies based on real-time conditions.


title: HISTORY
content:
The <b>pamexec</b> utility is part of the Pluggable Authentication Modules (PAM) framework, which was originally developed by Sun Microsystems in the mid-1990s and later adopted by the OpenGroup as a standard. <b>pamexec</b> emerged as a helper program within this framework, specifically designed to facilitate the execution of external commands by PAM modules like <i>pam_exec.so</i>. Its development is tied to the evolution of PAM itself, aiming to provide a flexible and extensible way for system administrators to customize authentication and session management behaviors through external scripts and programs.


title: PARAMETERS
content:
<b>[-f | --file]=<I>file_name</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the <B>PAM</B> configuration file to parse. When this option is used, <I>pamfile</I> reads from the specified file path.<br><br><b>[-s | --service]=<I>service_name</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the <B>PAM</B> service to display. When this option is used, <I>pamfile</I> will look for a configuration file named <I>service_name</I> within the <I>/etc/pam.d/</I> directory.<br><br><b>[-v | --verbose]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, providing more detailed information during parsing and display, which can be helpful for debugging.<br><br><b>[-q | --quiet]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses normal output, showing only error messages. This can be useful for scripting or when checking only for parsing errors.<br><br><b>[-h | --help]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message with usage instructions for the <I>pamfile</I> command and then exits.<br><br><b>[-V | --version]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the version information of the <I>pamfile</I> utility and then exits.<br><br>


title: DESCRIPTION
content:
<I>pamfile</I> is a utility designed to parse and display the contents of a <B>PAM (Pluggable Authentication Modules)</B> configuration file in a human-readable format. Its primary purpose is to help administrators and developers debug or understand how <B>PAM</B> modules are configured for various services. It takes a <B>PAM</B> configuration file (typically located in <I>/etc/pam.d/</I> or <I>/etc/pam.conf</I>) as input and outputs a structured representation of the rules defined within it.<br><br>This output often includes details like the module type (e.g., <I>auth</I>, <I>account</I>, <I>password</I>, <I>session</I>), control flag (e.g., <I>required</I>, <I>requisite</I>, <I>sufficient</I>, <I>optional</I>), module path, and any arguments passed to the module. By pretty-printing the configuration, <I>pamfile</I> makes it easier to spot syntax errors, verify module loading order, and ensure that authentication policies are correctly applied. It's an invaluable tool for maintaining the security and integrity of a Linux system's authentication subsystem.


title: CAVEATS
content:
It's important to note that <I>pamfile</I> is a read-only utility; it does not modify any <B>PAM</B> configuration files. Its purpose is purely for inspection and debugging. While it parses the syntax, it does not perform semantic validation of the <B>PAM</B> modules or their arguments (e.g., it won't check if a module path exists or if specific arguments are valid for a particular module).


title: TYPICAL USAGE
content:
<I>pamfile</I> is often used to inspect a specific service's <B>PAM</B> configuration, such as <I>sudo</I> or <I>sshd</I>, by running <I>pamfile -s sudo</I> or <I>pamfile -s sshd</I>. Alternatively, an administrator might directly analyze a configuration file like <I>/etc/pam.d/common-auth</I> using <I>pamfile -f /etc/pam.d/common-auth</I> for a deeper understanding of its rules.


title: OUTPUT FORMAT
content:
The output of <I>pamfile</I> typically lists each rule line by line, providing a clear, structured format. For each rule, it shows the module type (<I>auth</I>, <I>account</I>, <I>password</I>, <I>session</I>), the control flag (<I>required</I>, <I>requisite</I>, <I>sufficient</I>, <I>optional</I>), the module path (the library file), and any arguments passed to the module. This detailed breakdown is designed for easy readability and debugging of <B>PAM</B> policies.


title: HISTORY
content:
<I>pamfile</I> is an integral part of the <B>Linux-PAM</B> (Pluggable Authentication Modules for Linux) project. <B>Linux-PAM</B> was developed to provide a flexible and robust authentication framework, inspired by the original <B>PAM</B> framework from Sun Microsystems. As <B>PAM</B> configurations grew in complexity, <I>pamfile</I> emerged as a crucial utility to aid system administrators and developers in understanding and debugging these critical authentication setups. Its development has mirrored the evolution and widespread adoption of the <B>PAM</B> standard across various Linux distributions, emphasizing ease of configuration inspection.


title: SYNOPSIS
content:
<b>pamfix</b> [<I>-maxval=<I>value</I></I>] [<I>-check</I>] [<I>-null</I>] [<I>-all</I>] [<I>pamfile</I>]


title: PARAMETERS
content:
<b>-maxval=<I>value</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the maximum sample value for all samples in the output image. If not provided, pamfix attempts to determine it from the input file or automatically calculates a suitable <I>maxval</I> if the input is malformed.<br><br><b>-check</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Performs a check for problems without attempting to fix them. It reports any detected issues to standard error and exits with a non-zero status if problems are found.<br><br><b>-null</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Instead of correcting problematic sample values (e.g., negative or values exceeding <I>maxval</I>) by clamping them, this option replaces them with a zero value.<br><br><b>-all</b><br>&nbsp;&nbsp;&nbsp;&nbsp;This option is often redundant as pamfix by default attempts to fix all common issues it can. Its explicit inclusion ensures all known fixable problems are addressed, though its primary effect might be on specific edge cases or for clarity in scripts.<br><br><b><I>pamfile</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input PAM image file to be processed. If this argument is omitted or specified as <b>-</b>, pamfix reads the image data from standard input.<br><br>


title: DESCRIPTION
content:
pamfix is a utility from the Netpbm image manipulation toolkit designed to rectify various common issues found in <I>Portable Arbitrary Map</I> (PAM) image files. PAM is a highly flexible image format, and while robust, files can occasionally be malformed due to various reasons, such as buggy image generation software or manual corruption. pamfix acts as a "sanity checker" and "repair tool" for such files.<br><br>It can correct problems like an invalid or zero maximum value (<I>maxval</I>), which defines the maximum sample value for the image. It also addresses sample values that are negative or exceed the specified <I>maxval</I>, clamping them to valid ranges. Furthermore, pamfix can resolve issues with tuple type strings in the PAM header, such as non-existent or duplicated entries, ensuring the header is correctly interpreted.<br><br>The command is particularly useful when dealing with image files produced by less strict programs that might generate slightly non-compliant PAMs. By default, pamfix reads from standard input if no file is specified and writes the corrected PAM image to standard output. Its output is always a PAM file, even if the original input was a different Netpbm format (PBM, PGM, PPM).


title: CAVEATS
content:
pamfix is designed to correct <I>common</I> malformations in PAM images, not every conceivable form of file corruption. Severely damaged or fundamentally incorrect image data may not be recoverable.<br><br>The output of pamfix is <I>always</I> in the PAM format, even if the input was a different Netpbm format like PBM, PGM, or PPM. If you require the output in a specific Netpbm format, you will need to pipe the output of pamfix to another Netpbm utility (e.g., pamtopnm).<br><br>While pamfix attempts to make files compliant, it cannot guarantee that the resulting image will be visually identical to what a perfectly formed original image might have been, especially when correcting sample values by clamping or nulling them.


title: STANDARD I/O USAGE
content:
If no input file is specified or if <b>-</b> is given as the filename, pamfix reads its input from standard input (<B>stdin</B>). The corrected PAM image is always written to standard output (<B>stdout</B>). This behavior allows pamfix to be easily integrated into shell pipelines, enabling complex image processing workflows where its output can be directly fed as input to another Netpbm utility.


title: EXIT STATUS
content:
pamfix typically exits with a status of <b>0</b> upon successful execution and correction of issues. If the <b>-check</b> option is used and problems are found, or if a fatal error occurs (e.g., unreadable input, severe corruption), it will exit with a non-zero status, indicating failure or the presence of uncorrected issues.


title: HISTORY
content:
pamfix is an integral part of the <B>Netpbm</B> project, a comprehensive toolkit for manipulating graphic images. The Netpbm suite has a long history dating back to the early days of Unix-like systems, evolving from the original PBMPLUS package by Jef Poskanzer.<br><br>The PAM (Portable Arbitrary Map) format itself was introduced later in the Netpbm project to provide a more flexible and extensible image format compared to the older PBM, PGM, and PPM formats, which are collectively known as PNM. pamfix was developed as a necessary utility to ensure the robustness and interoperability of PAM files, particularly when dealing with images generated by a wide variety of tools, thus contributing to the stability and utility of the Netpbm ecosystem.


title: SEE ALSO
content:
pnm(5): Describes the Portable Anymap format (PBM, PGM, PPM) which are subsets of PAM., pam(5): Describes the Portable Arbitrary Map (PAM) format in detail., pnmcheck(1): Checks a Netpbm image for consistency problems. pamfix fixes issues that pnmcheck might find., anytopam(1): Converts an arbitrary image file to a PAM image., pamtopnm(1): Converts a PAM image to PBM, PGM, or PPM format.


title: PARAMETERS
content:
<b><i>width</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the exact width (in pixels) that all rows in the output image should have. If this argument is omitted, <i>pamfixtrunc</i> attempts to automatically determine the correct width by examining the first non-truncated row it finds in the input. If no such row can be found (e.g., all rows are truncated, or the image consists of only a single truncated row), an error will occur, and an explicit <i>width</i> must be provided.<br><br><b><i>pam input</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the Netpbm image file that needs processing. If this argument is not provided, <i>pamfixtrunc</i> will read the image data from standard input (stdin). This allows it to be easily integrated into command pipelines.<br><br>


title: DESCRIPTION
content:
<i>pamfixtrunc</i> is a specialized utility from the Netpbm suite designed to repair Netpbm image files that suffer from malformed rows. It addresses two primary issues: rows that are too short (truncated) and rows that are too long. When a row is truncated, <i>pamfixtrunc</i> intelligently pads it with black pixels to reach the correct image width. Conversely, if a row exceeds the specified or inferred width, it is trimmed to the correct length. This tool is invaluable for correcting image files produced by buggy software that might write incomplete data rows, or for files that become corrupted during transfer, leading to partial or oversized row data. It can infer the correct image width from the first complete row encountered, but requires an explicit width argument if all rows are malformed or if the image is a single, truncated row. It operates as a filter, reading image data from standard input and outputting the corrected image to standard output.


title: CAVEATS
content:
If you do not specify the <i>width</i> argument and the input Netpbm image contains only truncated rows, or is simply a single truncated row, <i>pamfixtrunc</i> will be unable to determine the correct image width automatically. In such scenarios, the command will fail, and you must explicitly provide the desired <i>width</i> as a command-line argument.


title: STANDARD I/O OPERATION
content:
True to the Unix philosophy, <i>pamfixtrunc</i> functions as a filter. It reads image data from standard input by default and writes the processed, corrected image to standard output. This design makes it highly versatile for use in shell pipelines, allowing it to be combined seamlessly with other Netpbm utilities or general-purpose Unix commands for complex image processing workflows.


title: SUPPORTED IMAGE FORMATS
content:
Being a Netpbm utility, <i>pamfixtrunc</i> is compatible with all Netpbm image formats. This includes PBM (Portable Bitmap), PGM (Portable Graymap), PPM (Portable Pixmap), and PAM (Portable Arbitrary Map). It internally processes all inputs as PAM format and outputs a PAM image, ensuring broad compatibility within the Netpbm ecosystem.


title: HISTORY
content:
<i>pamfixtrunc</i> is an integral part of the Netpbm suite, a venerable and comprehensive collection of graphics manipulation tools for Unix and Linux systems. The Netpbm project originated from the PBMplus toolkit in the early 1990s and has since undergone continuous development, maintaining its focus on simple, pipe-friendly image filters. <i>pamfixtrunc</i> addresses a specific and practical problem of corrupted or malformed image data streams, reflecting the suite's robust approach to handling diverse image inputs.


title: PARAMETERS
content:
<b>-horiz</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Flips the image horizontally (left-to-right).<br><br><b>-vert</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Flips the image vertically (top-to-bottom).<br><br><b>-lr</b><br>&nbsp;&nbsp;&nbsp;&nbsp;An alias for -horiz, also flips the image horizontally.<br><br><b>-tb</b><br>&nbsp;&nbsp;&nbsp;&nbsp;An alias for -vert, also flips the image vertically.<br><br>


title: DESCRIPTION
content:
<I>pamflip</I> is a utility from the Netpbm suite of graphics tools, designed specifically for manipulating Portable Anymap (PAM) images. Its primary function is to flip an image along either its horizontal or vertical axis. When flipping horizontally, the image is mirrored left-to-right, effectively reversing the order of pixels in each row. When flipping vertically, the image is mirrored top-to-bottom, reversing the order of rows. <br><br>This command operates as a filter, meaning it typically reads an image from standard input and writes the flipped image to standard output. This allows it to be easily integrated into shell pipelines, chaining with other Netpbm utilities for complex image processing tasks. <br><br><I>pamflip</I> can handle all Netpbm formats (PBM, PGM, PPM, and PAM) as input, automatically converting them to the PAM format internally for processing, then outputting the result in PAM format. It is a fundamental tool for basic image manipulation within the Netpbm ecosystem.


title: CAVEATS
content:
<I>pamflip</I> can only perform one type of flip (horizontal or vertical) per invocation. To perform both a horizontal and vertical flip, you must pipe the output of one <I>pamflip</I> command to another. For example, <B>pamflip -horiz | pamflip -vert</B>. It does not support arbitrary rotations or other transformations.


title: USAGE EXAMPLES
content:
To flip an image named <I>input.pam</I> horizontally and save it as <I>output_h.pam</I>:<br><B>pamflip -horiz input.pam > output_h.pam</B><br><br>To flip an image read from a pipeline vertically:<br><B>convert image.jpg pgm:- | pamflip -vert > flipped.pam</B><br><br>To flip an image both horizontally and vertically:<br><B>pamflip -horiz input.pam | pamflip -vert > output_hv.pam</B>


title: INPUT AND OUTPUT
content:
<I>pamflip</I> primarily works as a filter. If no input file is specified, it reads a PAM image from standard input. The resulting flipped PAM image is always written to standard output. This design allows for seamless integration into complex shell scripts and pipelines for image manipulation.


title: HISTORY
content:
<I>pamflip</I> is part of the Netpbm project, which originated from the Pbmplus package developed by Jef Poskanzer in the late 1980s. The Netpbm suite evolved to include more robust and unified tools under the Portable Anymap (PAM) format specification. <I>pamflip</I> was introduced as a modern equivalent or successor to <I>pnmflip</I>, designed to uniformly handle all Netpbm image types (PBM, PGM, PPM, and the newer PAM format) via the versatile PAM interface. Its development reflects the Netpbm project's goal of providing a comprehensive, modular toolkit for image processing in a Unix-like environment.


title: SYNOPSIS
content:
<b>pamfunc</b> [<i>--function=<function_name></i>] [<i>--truecolor</i>] [<i>--verbose</i>] [<i>--maxval=<maxval></i>] [<i>--tupletype=<tupletype></i>] [<i>&lt;input_image_file&gt;</i>]


title: PARAMETERS
content:
<b><i>--function=&lt;function_name&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the mathematical function to apply to each sample. Examples include: <i>abs</i>, <i>ceil</i>, <i>floor</i>, <i>exp</i>, <i>log</i>, <i>log10</i>, <i>sin</i>, <i>cos</i>, <i>tan</i>, <i>asin</i>, <i>acos</i>, <i>atan</i>, <i>sinh</i>, <i>cosh</i>, <i>tanh</i>, <i>sqrt</i>, <i>cbrt</i>, <i>round</i>, <i>trunc</i>.<br><br><b><i>--truecolor</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Allows the output image to be truecolor, even if the input image is grayscale or black and white. This affects how color components are handled during processing.<br><br><b><i>--verbose</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages and progress updates to standard error during the command's execution.<br><br><b><i>--maxval=&lt;maxval&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the maximum sample value for the output image. By default, the output image will have the same maximum value as the input image.<br><br><b><i>--tupletype=&lt;tupletype&gt;</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the tuple type for the output image, such as <i>RGB</i>, <i>GRAYSCALE</i>, etc. This influences the interpretation of the image's pixel data.<br><br>


title: DESCRIPTION
content:
<b>pamfunc</b> is a specialized invocation of the <b>pamarith</b> Netpbm program, designed to apply a mathematical function to each individual sample (pixel component) of a Netpbm image. It serves as a powerful utility for performing element-wise transformations on image data. The command reads a single Netpbm image – which can be in PBM, PGM, PPM, or PAM format – from standard input by default, or from a specified file, and then outputs the transformed image to standard output. <br><br>The core functionality is driven by the <i><b>--function</b></i> option, which allows users to specify a wide array of standard mathematical operations such as absolute value (<i><b>abs</b></i>), ceiling (<i><b>ceil</b></i>), floor (<i><b>floor</b></i>), exponential (<i><b>exp</b></i>), logarithm (<i><b>log</b></i>), trigonometric functions (<i><b>sin</b></i>, <i><b>cos</b></i>, <i><b>tan</b></i>), inverse trigonometric functions, hyperbolic functions, and roots (<i><b>sqrt</b></i>, <i><b>cbrt</b></i>). For color images, <b>pamfunc</b> applies the chosen function independently to the red, green, and blue components of each pixel. This enables precise control over image intensity, contrast, and other visual attributes through mathematical modeling. Its integration within the Netpbm suite makes it highly interoperable with other image manipulation tools via piping.


title: CAVEATS
content:
<b>pamfunc</b> is primarily a symbolic link to <b>pamarith</b>, defaulting to the 'func' operation. Functions are applied independently to each color component for color images. Care must be taken with input values that might lead to undefined or non-finite results for certain mathematical functions (e.g., negative numbers for <i>log</i> or <i>sqrt</i>), as these are often clamped or result in 0 in the output.


title: INPUT/OUTPUT
content:
By default, <b>pamfunc</b> reads a single Netpbm image from standard input. If an <i>&lt;input_image_file&gt;</i> is specified, it reads from that file instead. The processed image is always written to standard output, making it highly suitable for piping with other Netpbm utilities.


title: SAMPLE PROCESSING
content:
For color images (PPM or PAM formats), the specified mathematical function is applied separately and independently to each of the red, green, and blue color components of every pixel. For grayscale (PGM) or black and white (PBM) images, the function operates on the single sample value per pixel.


title: HISTORY
content:
<b>pamfunc</b> is an integral part of the Netpbm project, a venerable suite of command-line tools for manipulating graphics files that originated in the early days of Unix. While the core functionality for arithmetic and functional operations resides within <b>pamarith</b>, <b>pamfunc</b> was created as a convenient symbolic link. This allows users to easily access the single-image mathematical transformation capabilities of <b>pamarith</b> by simply invoking <b>pamfunc</b>, reflecting the long-standing need for element-wise image processing operations in various applications.


title: PARAMETERS
content:
<b><B>--help</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display usage information and exit.<br><br><b><B>--list-sinks</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;List all available PulseAudio sinks (audio output devices).<br><br><b><B>--list-sources</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;List all available PulseAudio sources (audio input devices).<br><br><b><B>--get-volume</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Get the current volume percentage of the selected sink.<br><br><b><B>--set-volume</B> <I>&lt;N&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the volume of the selected sink to <I>N</I> percent.<br><br><b><B>--increase</B> <I>&lt;N&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Increase the volume of the selected sink by <I>N</I> percent.<br><br><b><B>--decrease</B> <I>&lt;N&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Decrease the volume of the selected sink by <I>N</I> percent.<br><br><b><B>--toggle-mute</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Toggle the mute status of the selected sink.<br><br><b><B>--mute</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Mute the selected sink.<br><br><b><B>--unmute</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Unmute the selected sink.<br><br><b><B>--get-mute</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Get the mute status (0 for unmuted, 1 for muted) of the selected sink.<br><br><b><B>--default-sink</B> <I>&lt;ID|Name&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the default PulseAudio sink by its ID or name.<br><br><b><B>--default-source</B> <I>&lt;ID|Name&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the default PulseAudio source by its ID or name.<br><br><b><B>--get-default-sink</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Get the name of the current default sink.<br><br><b><B>--get-default-source</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Get the name of the current default source.<br><br><b><B>--sink</B> <I>&lt;ID|Name&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Perform the operation on the specified sink instead of the default one. Can be an ID or a part of the sink's name.<br><br><b><B>--source</B> <I>&lt;ID|Name&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Perform the operation on the specified source instead of the default one. Can be an ID or a part of the source's name.<br><br><b><B>--allow-boost</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Allow volume to be set above 100% (up to PulseAudio's maximum, typically 153%).<br><br><b><B>--print-volume</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Print the volume percentage after a change operation (e.g., increase, decrease, set).<br><br><b><B>--format</B> <I>&lt;FORMAT_STRING&gt;</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the output format for volume/mute status using placeholders (e.g., <I>{p}</I> for percentage, <I>{m}</I> for mute status).<br>Example: <I>pamixer --get-volume --format '{p}% {m}'</I><br><br>


title: DESCRIPTION
content:
<i>pamixer</i> is a lightweight command-line utility designed specifically for interacting with the PulseAudio sound server. It provides a straightforward and efficient way to control audio output (sinks) and input (sources) directly from the terminal, making it ideal for scripting, keyboard shortcuts, or users who prefer a non-graphical interface. Unlike more comprehensive PulseAudio tools like <i>pactl</i> or <i>pacmd</i>, <i>pamixer</i> focuses on common mixer operations such as adjusting volume levels, muting/unmuting devices, and setting default sinks/sources. Its simplicity allows for quick adjustments without delving into complex PulseAudio internals, offering a fast and convenient way to manage your audio.


title: CAVEATS
content:
Requires PulseAudio to be running: <i>pamixer</i> interacts directly with the PulseAudio sound server. It will not function if PulseAudio is not active, or if your system uses a different sound server like ALSA directly or PipeWire without a PulseAudio compatibility layer.<br><br>Limited scope: While excellent for basic mixer controls, <i>pamixer</i> does not offer the advanced features of <i>pactl</i> or <i>pacmd</i> such as module loading, stream manipulation, or detailed client information.


title: <B>SCRIPTING AND INTEGRATION</B>
content:
<i>pamixer</i>'s straightforward syntax and single-purpose commands make it exceptionally well-suited for shell scripting. Users often integrate <i>pamixer</i> into their status bars (e.g., with <i>i3status</i>, <i>polybar</i>, or custom scripts) to display current volume and mute status, and configure keyboard shortcuts to quickly adjust audio levels, toggle mute, or switch audio devices. Its output can be easily parsed, further enhancing its utility in automated tasks.


title: HISTORY
content:
<i>pamixer</i> emerged as a simpler, more user-friendly alternative to the sometimes verbose and complex <i>pactl</i> for common volume and mute operations within the PulseAudio ecosystem. Its development reflects a common trend in command-line tools towards focused functionality and ease of use, particularly beneficial for integration into shell scripts, custom keybindings, and minimalist desktop environments. It provides a quick way to control the PulseAudio server without needing to parse complex <i>pactl</i> outputs or invoke a full interactive shell with <i>pacmd</i>.


title: PARAMETERS
content:
<b><i>pamfile1</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input PAM image to be used for the odd scan lines. If '<i>-</i>', it reads from standard input.<br><br><b><i>pamfile2</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input PAM image to be used for the even scan lines. If '<i>-</i>', it reads from standard input. If both <i>pamfile1</i> and <i>pamfile2</i> are omitted, both images are read sequentially from standard input.<br><br><b><b>-alpha</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If specified, <i>pammixinterlace</i> expects the input images to be 4-channel PAM images (e.g., RGB_ALPHA), and it will interleave the alpha channel along with the color channels. If omitted, only the color channels are processed, and any alpha channel in the input is ignored or discarded.<br><br><b><b>-fieldrows=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;This option allows specifying the number of rows that constitute a "field" in the interlacing process. By default, <i>N</i> is 1, meaning it interleaves row by row. If set to 2, for example, it would take two rows from the first image, then two from the second, and so on. This provides flexibility for non-standard scan patterns.<br><br><b><b>-help</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a brief usage message and exits.<br><br><b><b>-version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the program's version information and exits.<br><br>


title: DESCRIPTION
content:
<i>pammixinterlace</i> is a Netpbm program that combines two input PAM (Portable Arbitrary Map) or PPM (Portable Pixmap) images into a single interlaced image.<br>It takes one image that represents the "odd" scan lines (e.g., from an odd field of a video) and another image representing the "even" scan lines (e.g., from an even field). The output image is constructed by interleaving the scan lines from these two inputs. This is particularly useful for video processing applications where fields might be processed separately and then need to be re-combined. The input images <b>must</b> have the same dimensions (width and height), and will be processed in the order given: the first input's rows become the odd rows of the output, and the second input's rows become the even rows.


title: CAVEATS
content:
Input images <b>must</b> have identical dimensions (width and height); otherwise, the program will terminate with an error.<br>The command primarily works with Netpbm formats (PAM/PPM). Ensure your input images are in a compatible format or convert them first using other Netpbm tools like <i>anytopnm</i>.


title: STANDARD INPUT/OUTPUT
content:
The command reads the first image from <i>pamfile1</i> and the second from <i>pamfile2</i>. If a filename is specified as '<i>-</i>', the image is read from standard input. If no filenames are given, both images are read sequentially from standard input.<br>The resulting interlaced image is always written to standard output. This design makes <i>pammixinterlace</i> highly suitable for integration into shell pipelines, allowing for seamless chaining with other Netpbm utilities.


title: HISTORY
content:
<i>pammixinterlace</i> is an integral part of the Netpbm project, a comprehensive toolkit for manipulating graphic images. Netpbm originated from the Pbmplus package, created by Jef Poskanzer in the late 1980s, and has undergone continuous development. This specific tool was developed to address the common video processing requirement of re-combining separated video fields, underscoring the toolkit's broad utility in both general image manipulation and specialized media processing.


title: DESCRIPTION
content:
The <b>pamnoraw</b> command is a utility from the Netpbm image processing toolkit. Its primary function is to convert a Netpbm image file from its 'raw' (binary) format into a 'plain' (ASCII) format. Netpbm images encompass various types including Portable Bitmap (PBM), Portable Graymap (PGM), Portable Pixmap (PPM), and Portable Arbitrary Map (PAM).<br><br>In the raw format, pixel data is stored as a direct byte stream, which is efficient for storage and processing. Conversely, the plain format represents each pixel value as an ASCII number, often separated by whitespace, making the file human-readable and easier to parse with non-Netpbm specific tools. This transformation increases file size but is beneficial for inspection, debugging, or when compatibility with tools expecting plain ASCII pixel data is required. By default, <b>pamnoraw</b> reads from standard input and writes the converted image to standard output.


title: CAVEATS
content:
Plain Netpbm files generated by <b>pamnoraw</b> are significantly larger than their raw (binary) counterparts and are slower for image processing applications to read and write. They are primarily intended for human inspection or interoperability with systems that specifically require ASCII numeric pixel data.


title: INPUT AND OUTPUT
content:
By default, <b>pamnoraw</b> reads the Netpbm image data from standard input (stdin). If an optional <i>netpbmfile</i> is provided as a command-line argument, it reads from that file instead. The converted plain Netpbm image is always written to standard output (stdout).


title: FORMAT CONVERSION DETAILS
content:
<b>pamnoraw</b> converts the <i>data section</i> of any Netpbm image (PBM, PGM, PPM, PAM) to its plain (ASCII numeric) representation. For PBM, PGM, and PPM, this means converting raw format P4, P5, P6 respectively to plain P1, P2, P3. For PAM, it converts the raw tuple data block to an ASCII representation of the tuple values, while maintaining the PAM header structure.


title: HISTORY
content:
<b>pamnoraw</b> is a long-standing utility within the Netpbm suite, which evolved from the earlier Pbmplus package. The Netpbm project emphasizes a philosophy of providing many small, specialized tools that can be combined (often via pipelines) to perform complex image manipulations. <b>pamnoraw</b> serves a fundamental role in this ecosystem by enabling easy inspection and manipulation of image data in a human-readable format, reflecting the toolkit's commitment to basic, composable image transformations.


title: SYNOPSIS
content:
<b>pamoil</b> [<i>-radius radius</i>] [<i>-color-count colors</i>] [<i>-random</i>] [<i>-seed seed</i>] [<i>-verbose</i>] [<i>netpbmfile</i>]


title: PARAMETERS
content:
<b><b>-radius</b> <i>radius</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the radius of the circular neighborhood (in pixels) used for the oil painting effect. A larger radius results in broader strokes and more significant smoothing. The default is 2.<br><br><b><b>-color-count</b> <i>colors</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reduces the number of distinct colors in the output image to the specified count. Lower values can create a more "posterized" or stylized oil painting look by simplifying color gradients. The default is 100.<br><br><b><b>-random</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;When specified, <b>pamoil</b> uses a random color from the neighborhood (after quantization) instead of the statistically dominant color (median/mode). This can introduce a different texture to the effect.<br><br><b><b>-seed</b> <i>seed</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the seed for the random number generator when the <b>-random</b> option is used. This allows for reproducible results when randomness is involved.<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Causes <b>pamoil</b> to print informational messages about its progress and operations to standard error.<br><br>


title: DESCRIPTION
content:
<b>pamoil</b> is a utility from the Netpbm toolkit designed to transform an input image into an approximation of an oil painting. It achieves this effect by analyzing the colors within a defined neighborhood (<i>radius</i>) around each pixel. For each neighborhood, <b>pamoil</b> typically identifies the most prevalent color (or a representative color after quantizing to a limited <i>color-count</i>) and replaces the central pixel's color with it.<br><br>This process smooths out detail while retaining some major color blocks, mimicking the broad strokes and texture of an oil painting. The command reads Netpbm format images (PAM, PPM, PGM) from standard input or a specified file and outputs the modified image in PAM format to standard output. It's a non-interactive tool primarily used in scripting or command-line workflows for artistic image manipulation.


title: CAVEATS
content:
<b>pamoil</b> can be computationally intensive and consume significant memory, especially when processing large images or using a large <b>-radius</b>. Processing time increases dramatically with radius size.<br><br>The "oil painting" effect is an algorithmic approximation; it may not perfectly replicate the nuanced textures and brushstrokes of a real oil painting. The visual quality depends heavily on the input image and chosen parameters.<br><br>As part of the Netpbm suite, it exclusively handles Netpbm image formats (PAM, PGM, PPM). Conversion utilities like <i>jpegtopam(1)</i> or <i>pngtopam(1)</i> are required for other image types.


title: INPUT AND OUTPUT FORMATS
content:
<b>pamoil</b> is designed to work with Netpbm image formats. It accepts PGM, PPM, or PAM format images as input, either from a specified file or standard input. The output image is always in the PAM (Portable Arbitrary Map) format, which is the most flexible Netpbm format, written to standard output.


title: HOW THE EFFECT IS ACHIEVED
content:
The core of the <b>pamoil</b> effect involves iterating through each pixel in the image. For each pixel, it examines a circular neighborhood of pixels defined by the <b>-radius</b> option. It then quantizes the colors within this neighborhood to the number specified by <b>-color-count</b> and determines the most dominant (or a random, if <b>-random</b> is used) color. The center pixel's color is then replaced with this dominant/random color. This process effectively reduces detail and emphasizes larger color blocks, characteristic of an oil painting.


title: HISTORY
content:
<b>pamoil</b> is a component of the comprehensive Netpbm package, which evolved from Jef Poskanzer's Pbmplus utilities (first released in 1988). The Netpbm project aims to provide a robust, modular set of tools for image manipulation based on simple, open image formats. <b>pamoil</b> was developed as one of the specialized filters within this toolkit, extending its capabilities for artistic image transformation. Its design aligns with the Unix philosophy of small, specialized tools that can be chained together.


title: PARAMETERS
content:
<b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informational messages to standard error describing the actions and progress of the command.<br><br><b><b>-plain</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(<i>Netpbm common option</i>) For Netpbm programs that can output both plain (ASCII) and raw (binary) formats, this option specifies plain output. However, PAM images are inherently binary, so this option typically has no effect on <b>pampick</b>'s output format.<br><br>


title: DESCRIPTION
content:
<i><b>pampick</b></i> is a utility from the Netpbm suite designed for selecting and extracting specific pixels or regions from a Portable Anymap (PAM) image. It reads a PAM image from standard input, applies a selection logic defined by its 'pick' argument, and then writes a new PAM image containing only the selected pixels to standard output.<br><br>This command is incredibly useful in image processing pipelines, allowing users to precisely control which parts of an image are passed to subsequent Netpbm tools or other image manipulation programs. It can pick single pixels, rectangular regions, or even grids of pixels within a specified area, making it a flexible tool for various image analysis and transformation tasks. Its design philosophy aligns with the Unix tradition of small, focused utilities that do one thing well and can be chained together.


title: CAVEATS
content:
The input image <i>must</i> be in the Portable Anymap (PAM) format. If the input is not a valid PAM, <b>pampick</b> will report an error. The 'pick' argument's syntax is strict and must be correctly formatted to avoid errors or unexpected selections.<br><br>As with most Netpbm tools, performance on extremely large images might be limited by system memory and processing power, though it's generally efficient for its intended purpose.


title: THE PICK ARGUMENT SYNTAX
content:
The <i>pick_argument</i> is the core mechanism by which <b>pampick</b> determines which pixels to select. It is a comma-separated string specifying coordinates and dimensions.<br><br>The coordinate system used is top-left (0,0), with X increasing to the right and Y increasing downwards.<br><br>Possible formats for <i>pick_argument</i> include:<br><i>x,y</i>: Selects a single pixel at the specified column (x) and row (y).<br><i>x,y,width,height</i>: Selects a rectangular region starting at (x,y) with the given <i>width</i> and <i>height</i>.<br><i>x,y,width,height,xstep,ystep</i>: Selects a grid of pixels within the specified rectangular region, picking every <i>xstep</i>-th pixel horizontally and every <i>ystep</i>-th pixel vertically.


title: INPUT AND OUTPUT
content:
<b>pampick</b> operates as a filter program, reading its input image from standard input (stdin) and writing the resulting image to standard output (stdout). This design makes it highly suitable for use in shell pipelines, where its output can be directly fed as input to another Netpbm tool or a different command, facilitating complex image processing workflows.


title: HISTORY
content:
<b>pampick</b> is an integral part of the Netpbm package, which evolved from the original PBMplus toolkit. Netpbm maintains a long and stable history as a fundamental suite of Unix-like image processing tools. <b>pampick</b> was developed to extend the pixel-level manipulation capabilities, offering a more granular selection mechanism than tools like <b>pamcut</b>, which primarily deals with rectangular regions.


title: SYNOPSIS
content:
<i>pampop9</i> <b>[--unknown-option]</b> <b>[<arg>]</b><br><br><i>Note: This synopsis is purely hypothetical as 'pampop9' is not a standard Linux command.</i>


title: PARAMETERS
content:
<b><i>No standard parameters.</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>'pampop9' is not a recognized Linux command, so no official parameters or options exist. Any parameters would be custom-defined if this command were part of a specific, non-standard application.</i><br><br>


title: DESCRIPTION
content:
The command 'pampop9' is not recognized as a standard or commonly documented utility within the Linux operating system. It does not appear in official manual pages, common command repositories, or widely-used distributions. Therefore, specific functionality, typical usage patterns, or its intended purpose cannot be described factually.<br><br>It's possible that 'pampop9' is a hypothetical command, a typo, a highly specialized internal tool specific to a very particular environment, or part of a custom script or application not publicly documented. Without further context or definition, its role and capabilities remain undefined in a general Linux context.


title: CAVEATS
content:
As 'pampop9' is not a standard Linux command, attempting to execute it on a typical system will likely result in a 'command not found' error. Any use or documentation of this command would be specific to a custom environment where it might be defined, and its behavior would depend entirely on that custom definition.


title: COMMAND EXISTENCE
content:
<i>'pampop9' does not correspond to any known, standard, or commonly installed Linux utility. Users encountering this command name should verify its source or context.</i>


title: HISTORY
content:
There is no documented history for 'pampop9' in standard Linux development or usage, as it is not a recognized command within the common Linux ecosystem. Its origin, if it exists, is specific to a private or highly specialized context.


title: SYNOPSIS
content:
<b>pamrgbatopng</b> [<i>options</i>] [<i>pam_file</i>]<br>Options:<br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-alpha</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-alphathresh=</b><i>val</i><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-alphafile=</b><i>file</i><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-interlaced</b><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-text=</b><i>"text_chunk"</i><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-comment=</b><i>"text_chunk"</i><br>&nbsp;&nbsp;&nbsp;&nbsp;<b>-verbose</b>


title: PARAMETERS
content:
<b><b>-alpha</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Informs <b>pamrgbatopng</b> that the input is an <b>RGBA PAM</b>, and its fourth plane should be treated as the alpha channel, preserving transparency.<br><br><b><b>-alphathresh=</b><i>val</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Creates an alpha channel from a non-alpha input. Pixels whose luminosity matches <i>val</i> (0-255) become fully transparent, suitable for color keying.<br><br><b><b>-alphafile=</b><i>file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses a separate <b>PGM</b> (Portable Graymap) or <b>PBM</b> (Portable Bitmap) <i>file</i> as the alpha channel for the output <b>PNG</b>. White means opaque, black means transparent.<br><br><b><b>-interlaced</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs an interlaced <b>PNG</b> image using the Adam7 algorithm, which allows for progressive rendering in compatible viewers.<br><br><b><b>-text=</b><i>"text_chunk"</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adds a textual data chunk (tEXt) to the <b>PNG</b> image metadata. This option can be used multiple times for different chunks, typically in 'keyword=text' format.<br><br><b><b>-comment=</b><i>"text_chunk"</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;An alias for the <b>-text</b> option, also used to embed textual metadata into the <b>PNG</b> file.<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages about the conversion process to standard error (stderr), which is useful for debugging or monitoring.<br><br><b><i>pam_file</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input <b>PAM</b> or <b>PPM</b> image file. If this argument is omitted, the command reads image data from standard input (stdin).<br><br>


title: DESCRIPTION
content:
<b>pamrgbatopng</b> is a specialized command within the <b>Netpbm</b> image processing suite, designed for converting Portable Arbitrary Map (<b>PAM</b>) and Portable Pixel Map (<b>PPM</b>) images to the Portable Network Graphics (<b>PNG</b>) format. Its key strength lies in its explicit support for images with alpha channels, allowing for the precise handling of transparency. While <b>Netpbm</b> also provides <b>pnmtopng(1)</b>, <b>pamrgbatopng</b> offers more granular control over alpha channel interpretation, especially when dealing with <b>RGBA</b> (Red, Green, Blue, Alpha) <b>PAM</b> files or when needing to add an alpha channel from a separate file or based on a color threshold.<br><br>The command reads an input <b>PAM</b> or <b>PPM</b> image, typically from standard input or a specified file, and outputs a <b>PNG</b> image to standard output. It's particularly useful in image processing pipelines where precise transparency management is critical, such as generating web graphics with complex alpha masks, converting legacy image data, or preparing assets for games and multimedia applications. It seamlessly integrates into shell scripts, leveraging the flexibility of the <b>Netpbm</b> toolkit.


title: CAVEATS
content:
This command is designed for <b>PAM</b>/<b>PPM</b> (color) inputs. While <b>Netpbm</b> can convert <b>PGM</b> (grayscale) or <b>PBM</b> (bitmap) to <b>PAM</b>, <b>pamrgbatopng</b> expects color data for its primary function.<br>It's part of the <b>Netpbm</b> suite; therefore, the <b>Netpbm</b> tools must be installed on your system.<br>For simple <b>PPM</b> to <b>PNG</b> conversions without specific alpha channel requirements, <b>pnmtopng(1)</b> might be a more direct alternative.


title: INPUT FLEXIBILITY
content:
Although its name suggests RGB, <b>pamrgbatopng</b> also correctly processes <b>RGBA PAM</b> inputs, directly utilizing the alpha channel for transparency in the output <b>PNG</b>. For non-RGBA inputs, it provides options (<b>-alphathresh</b>, <b>-alphafile</b>) to generate an alpha channel during conversion.


title: OUTPUT FORMAT
content:
The command strictly outputs to the <b>PNG</b> format. If other output formats are desired, the <b>PNG</b> output would typically need to be piped to another <b>Netpbm</b> converter (e.g., <b>pngtopam | pamto<format></b>).


title: HISTORY
content:
The <b>pamrgbatopng</b> command is a component of the comprehensive <b>Netpbm</b> graphics library, a long-standing collection of open-source tools for manipulating image files. <b>Netpbm</b> itself evolved from earlier image toolsets like <b>PBMplus</b>, which dates back to the late 1980s. As image formats and requirements grew more complex, particularly with the rise of alpha channels for transparency, <b>Netpbm</b> introduced the more flexible <b>PAM</b> (Portable Arbitrary Map) format. <b>pamrgbatopng</b> was developed to specifically leverage <b>PAM</b>'s capabilities, especially its native support for alpha channels, providing a dedicated and robust method for converting these advanced Netpbm formats into the widely used <b>PNG</b> standard. Its development reflects the continuous adaptation of <b>Netpbm</b> to modern image processing needs.


title: PARAMETERS
content:
<b>-xscale <float>, -yscale <float></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Scale the image by the specified horizontal and vertical factors.<br><br><b>-xsize <pixels>, -ysize <pixels></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Resize the image to the exact horizontal and vertical pixel dimensions.<br><br><b>-width <pixels>, -height <pixels></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Aliases for <i>-xsize</i> and <i>-ysize</i>, respectively.<br><br><b>-maxwidth <pixels>, -maxheight <pixels></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Scale the image down only if necessary, to fit within the maximum specified width and height, preserving aspect ratio.<br><br><b>-xfill <pixels>, -yfill <pixels></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Scale the image to fill the specified width or height, maintaining aspect ratio.<br><br><b>-filter <name></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the interpolation filter algorithm to use (e.g., <i>triangle</i>, <i>gaussian</i>, <i>lanczos3</i>).<br><br><b>-fill=<color></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the color for areas that need to be filled, for example, when stretching to fill a bounding box.<br><br><b>-reduce</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Only reduce the image size; never enlarge it beyond its original dimensions.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Print detailed scaling information and progress to standard error.<br><br><b>-resize</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use the faster, but generally lower quality, <i>pamstretch</i> algorithm for scaling.<br><br><b>-nomax</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Overrides <i>-maxwidth</i>/<i>-maxheight</i> restrictions when scaling up.<br><br><b>-trueheight</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Interpret <i>-maxheight</i> as the true image height, including any hidden or marginal pixels.<br><br><b>-pixelratio <float></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adjust the image's aspect ratio based on non-square pixels.<br><br><b>imagefile</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input <i>Netpbm</i> image file. If omitted, <b>pamscale</b> reads from standard input.<br><br>


title: DESCRIPTION
content:
<b>pamscale</b> is a powerful command-line utility from the <i>Netpbm</i> project, designed for resizing images stored in <i>Netpbm</i> formats (PBM, PGM, PPM, and PAM). It offers precise control over the scaling process, allowing users to resize images by a specific factor, or to exact pixel dimensions, while intelligently preserving the aspect ratio to prevent distortion. A key feature is its support for various interpolation filters, such as <i>triangle</i>, <i>gaussian</i>, and <i>lanczos3</i>, which are crucial for maintaining image quality and minimizing common resizing artifacts like aliasing, blurring, or pixellation. Whether you need to enlarge images for detailed viewing or reduce them for web optimization, <b>pamscale</b> can handle both operations. It also provides flexible options for fitting images within defined maximum dimensions or filling specific areas, making it a versatile tool for automated image preprocessing workflows before further manipulation or display.


title: CAVEATS
content:
<b>pamscale</b> operates exclusively on <i>Netpbm</i> formats. For images in other formats (like JPEG, PNG, TIFF), they must first be converted to a <i>Netpbm</i> format using appropriate tools (e.g., <i>jpegtopam</i>, <i>pngtopam</i>). The quality of the output image is highly dependent on the chosen <i>-filter</i> and the scaling factor; aggressive scaling with an inappropriate filter can lead to noticeable artifacts. Processing very large images might consume significant memory.


title: INTERPOLATION FILTERS
content:
<b>pamscale</b> provides a rich set of interpolation filters to control the quality of the resized image. These include common filters like <i>triangle</i> (often a good default for balanced quality), <i>box</i> (nearest neighbor, fastest but lowest quality), <i>gaussian</i>, <i>quadratic</i>, <i>catrom</i>, <i>mitchell</i>, and high-quality options such as <i>lanczos2</i> and <i>lanczos3</i>, which are known for producing sharp results with minimal aliasing. Selecting the appropriate filter is crucial for achieving desired visual characteristics.


title: ASPECT RATIO PRESERVATION
content:
By default, or when using options like <i>-maxwidth</i>/<i>-maxheight</i> or <i>-xfill</i>/<i>-yfill</i> where only one dimension is explicitly set, <b>pamscale</b> intelligently preserves the original aspect ratio of the input image. This ensures that images are scaled without distortion, maintaining their correct proportions. This behavior can be overridden by explicitly specifying both <i>-xsize</i> and <i>-ysize</i>, which will force the image to stretch to the exact dimensions provided.


title: HISTORY
content:
<b>pamscale</b> is a core component of the <i>Netpbm</i> suite of graphics utilities, which evolved from the original <i>Pbmplus</i> package developed in the late 1980s. It significantly improved upon its predecessor, <i>pnmscale</i>, by introducing a much wider range of interpolation filters and more sophisticated scaling algorithms, offering superior image quality and flexibility for modern image processing tasks compared to earlier Netpbm scaling tools.


title: SYNOPSIS
content:
<b>pamshadedrelief</b> [<i>options</i>] [<i>input_image</i>]<br>If <i>input_image</i> is omitted, <b>pamshadedrelief</b> reads from standard input.


title: PARAMETERS
content:
<b><b>-azimuth=<i>angle</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the horizontal angle (azimuth) of the virtual light source, in degrees. 0 degrees is from the east, increasing clockwise.<br><br><b><b>-elevation=<i>angle</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the vertical angle (elevation) of the virtual light source, in degrees. 0 degrees is on the horizon, 90 degrees is directly overhead.<br><br><b><b>-vertical-exaggeration=<i>factor</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;A floating-point value that controls the vertical scaling of the terrain relative to its horizontal extent. A factor of 1 means no exaggeration; values greater than 1 exaggerate vertical features.<br><br><b><b>-input-type=<i>height|slope</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies how input pixel values should be interpreted. <i>height</i> (default) means values are elevations. <i>slope</i> means values represent pre-calculated slope.<br><br><b><b>-output-type=<i>intensity|composite</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Determines the type of output image. <i>intensity</i> (default) produces a new grayscale image based solely on light intensity. <i>composite</i> overlays the shaded relief onto the original image (if input is grayscale).<br><br><b><b>-output-value-range=<i>minval:maxval</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Maps the calculated light intensity values to a specific output pixel value range. This can be used to stretch or compress the output contrast.<br><br><b><b>-nocomment</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents <b>pamshadedrelief</b> from writing comments (like its command line) into the output file's header.<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs informational messages about the processing steps to standard error.<br><br>


title: DESCRIPTION
content:
The <b>pamshadedrelief</b> command, part of the Netpbm toolkit, transforms a grayscale image into a shaded relief map, creating the illusion of three-dimensional terrain.<br><br>It interprets the input image's pixel values as heights (or slopes), calculating the local surface normal based on these values. A virtual light source, whose position can be controlled by the user, then illuminates this calculated terrain. The output image's pixel intensities correspond to how brightly each point on the simulated terrain would be lit, effectively visualizing features like hills, valleys, and ridges.<br><br>This utility is particularly useful for visualizing Digital Elevation Models (DEMs) or other height map data, providing a more intuitive and visually appealing representation of topographic features. It supports various Netpbm input formats, including PGM and PAM.


title: CAVEATS
content:
The command assumes that the input image's pixels have a square aspect ratio. If pixels are not square, the resulting relief may appear distorted. Furthermore, the interpretation of input values as height is linear; non-linear height scales must be pre-processed.<br>It is important to remember that this is an approximation of 3D relief; it does not perform full 3D rendering.


title: INPUT IMAGE INTERPRETATION
content:
The input image to <b>pamshadedrelief</b> is typically a grayscale image (PGM or a single-channel PAM) where each pixel's value represents an elevation or height. By default, darker pixels are considered lower elevations and brighter pixels higher, creating a topological map for the command to process.<br><br>The resolution of the input image directly affects the detail of the generated relief.


title: OUTPUT IMAGE CHARACTERISTICS
content:
The output is also a grayscale image (PGM or PAM), but its pixel values now represent the intensity of light reflected from the simulated terrain. Brighter areas indicate surfaces facing the virtual light source, while darker areas are in shadow. This results in an image that visually simulates hills and valleys, enhancing the perception of depth and terrain features.


title: HISTORY
content:
<b>pamshadedrelief</b> is an integral part of the Netpbm image processing suite, a collection of graphics utilities that has been continuously developed since the early 1990s. Netpbm originated from a set of simple image format converters and tools, later expanding to include more complex image manipulation capabilities like shaded relief generation.<br><br>The `pam` prefix indicates its compatibility with the Portable Arbitrary Map (PAM) format, a versatile Netpbm format that can represent various types of image data, including multi-channel and depth-varying images, which made the implementation of advanced features like <b>pamshadedrelief</b> more robust and flexible than with older Netpbm formats.


title: SYNOPSIS
content:
<br><B>pamslice</B> [<I>-rows=<B>toprow</B>:<B>bottomrow</B></I>] [<I>-cols=<B>leftcol</B>:<B>rightcol</B></I>]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<I>-rowoffset=<B>offset</B></I>] [<I>-coloffset=<B>offset</B></I>]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<I>-fillval=<B>value</B></I>] [<I>-fillcolor=<B>color</B></I>]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<I>-fillcolor-source=<B>source</B></I>] [<I>-fillcolor-source-tupletype=<B>tupletype</B></I>]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<I>-noautobackfill</I>] [<I>-background=<B>color</B></I>] [<I>-noverbose</I>]<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[<I>--</I>] [<I><B>pamfile</B></I>]


title: PARAMETERS
content:
<b>-rows=<B>toprow</B>:<B>bottomrow</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the range of rows to extract from the input image. Rows are 0-indexed. If not specified, all rows are included.<br><br><b>-cols=<B>leftcol</B>:<B>rightcol</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the range of columns to extract from the input image. Columns are 0-indexed. If not specified, all columns are included.<br><br><b>-rowoffset=<B>offset</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the <I>rowoffset</I> value in the output PAM header to <B>offset</B>. Defaults to the <B>toprow</B> value of the slice.<br><br><b>-coloffset=<B>offset</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the <I>coloffset</I> value in the output PAM header to <B>offset</B>. Defaults to the <B>leftcol</B> value of the slice.<br><br><b>-fillval=<B>value</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a single channel value (0 to <I>maxval</I>) to fill areas of the output image that extend beyond the input image boundaries. Overrides <I>-fillcolor</I>.<br><br><b>-fillcolor=<B>color</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a color (e.g., <I>red</I>, <I>rgb(255,0,0)</I>) to fill areas of the output image that extend beyond the input image boundaries. This is typically for multi-channel images.<br><br><b>-fillcolor-source=<B>source</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines the color space for the <B>color</B> specified by <I>-fillcolor</I>. Examples include <I>srgb</I> or <I>linear-rgb</I>. Default is <I>srgb</I>.<br><br><b>-fillcolor-source-tupletype=<B>tupletype</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the tuple type of the <B>color</B> specified by <I>-fillcolor</I>, if it differs from the input image's tuple type.<br><br><b>-noautobackfill</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents <B>pamslice</B> from automatically filling expanded areas with black when no explicit fill color/value is given. Without this, black is the default background fill.<br><br><b>-background=<B>color</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;An obsolete synonym for <I>-fillcolor</I>. It is recommended to use <I>-fillcolor</I> instead.<br><br><b>-noverbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses any informational messages or warnings that <B>pamslice</B> might otherwise print to standard error.<br><br><b><B>pamfile</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input PAM image file. If omitted, <B>pamslice</B> reads the image data from standard input.<br><br><b>--</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Signals the end of options, allowing subsequent arguments that might start with a hyphen to be interpreted as filenames.<br><br>


title: DESCRIPTION
content:
<B>pamslice</B> is a utility from the Netpbm toolkit, designed to extract a specific rectangular portion (slice) from a Portable Arbitrary Map (PAM) image. It can read PAM images from standard input or a specified file and write the resulting slice to standard output. Beyond simple cropping, <B>pamslice</B> offers the unique ability to "expand" the slice beyond the original image boundaries. When the requested slice extends outside the source image, the tool can fill the expanded areas with a user-defined background color or value, allowing for the creation of larger canvases with specific background fills. This makes <B>pamslice</B> useful for tasks like preparing images for tiling, extracting sub-regions, or creating images with borders. It processes images channel by channel, respecting the original image's depth and tuple type.


title: CAVEATS
content:
<ul><li><B>pamslice</B> primarily works with PAM images. While Netpbm tools often handle implicit conversions from other formats, direct PAM input is preferred for consistency.</li><li>Row and column coordinates are 0-indexed.</li><li>When expanding the slice beyond the original image, ensure a <I>fillval</I> or <I>fillcolor</I> is specified, or be aware of the default black fill (if <I>-noautobackfill</I> is not used).</li><li>The <I>maxval</I> of the output image will match the <I>maxval</I> of the input image. Any specified fill values or colors should be within this range.</li></ul>


title: HISTORY
content:
<B>pamslice</B> is a component of the Netpbm project, a long-standing and widely used toolkit for graphics manipulation. Netpbm originated from <I>pbmplus</I> in the late 1980s and has evolved considerably since then. <B>pamslice</B> itself was introduced as part of the expansion of Netpbm to include the Portable Arbitrary Map (PAM) format, which offers more flexibility than the older PBM, PGM, and PPM formats by supporting arbitrary tuple types and depths. Its development reflects the project's continuous effort to provide robust and versatile command-line tools for image processing, focusing on simplicity and interoperability within the Unix philosophy.


title: SYNOPSIS
content:
<b>pamsplit</b> [<i>-pad</i>] [<i>-width</i> <i>width</i>] [<i>-height</i> <i>height</i>] [<i>-left</i> <i>left</i>] [<i>-top</i> <i>top</i>] [<i>-cols</i> <i>cols</i>] [<i>-rows</i> <i>rows</i>] [<i>-exact</i>] [<i>-output</i> <i>output_name_template</i>] [<i>-filenumber</i> <i>start_number</i>] [<i>-digits</i> <i>digits</i>] [<i>-nullpad</i>] [<i>-rowmajor</i>] [<i>-frame</i> <i>frame_number</i>] [<i>-frames</i> <i>number_of_frames</i>] [<i>-startframe</i> <i>start_frame_number</i>] [<i>-verbose</i>] [<i>inputfile</i>]


title: PARAMETERS
content:
<b>-pad</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Pads split images that are smaller than the specified dimensions with black pixels.<br><br><b>-width <I>width</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the desired width in pixels for each split output image.<br><br><b>-height <I>height</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the desired height in pixels for each split output image.<br><br><b>-left <I>left</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the X-coordinate of the left edge of the first split image's bounding box.<br><br><b>-top <I>top</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the Y-coordinate of the top edge of the first split image's bounding box.<br><br><b>-cols <I>cols</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Divides the input image into the specified number of columns. The width of each split image is then determined implicitly.<br><br><b>-rows <I>rows</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Divides the input image into the specified number of rows. The height of each split image is then determined implicitly.<br><br><b>-exact</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Requires that the split images exactly match the specified dimensions. If not, an error occurs.<br><br><b>-output <I>output_name_template</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines the template for the output filenames. Use <I>%n</I> for sequential numbers and <I>%N</I> for frame numbers.<br><br><b>-filenumber <I>start_number</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the starting number for the <I>%n</I> placeholder in the output filenames (default is 0).<br><br><b>-digits <I>digits</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the minimum number of digits for the sequential number in output filenames, padding with leading zeros if necessary.<br><br><b>-nullpad</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Pads the sequential numbers with null characters (ASCII 0) instead of zeros. Useful for specific naming schemes.<br><br><b>-rowmajor</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Changes the splitting order to proceed row by row first, then column by column (default is column by column first).<br><br><b>-frame <I>frame_number</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Extracts a single specific frame from a multi-image stream (0-indexed).<br><br><b>-frames <I>number_of_frames</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the total number of frames to extract, starting from the frame defined by <I>-startframe</I>.<br><br><b>-startframe <I>start_frame_number</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the starting frame number for extraction when using <I>-frames</I>.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informational messages during processing, detailing the actions <I>pamsplit</I> performs.<br><br><b>inputfile</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input Netpbm image file. If omitted, <I>pamsplit</I> reads from standard input.<br><br>


title: DESCRIPTION
content:
<I>pamsplit</I> is a Netpbm command-line utility designed to divide a single Netpbm image or a stream of images into multiple smaller, separate image files. It reads input from standard input by default or from a specified file.<br><br>Users can define how the image should be split: either by specifying the exact <I>width</I> and <I>height</I> for each output sub-image, or by defining a grid using <I>-cols</I> and <I>-rows</I>. When using grid dimensions, the output image dimensions are implicitly calculated from the input image size. It also supports padding smaller sub-images with black using the <I>-pad</I> option.<br><br>Beyond spatial splitting, <I>pamsplit</I> is capable of extracting individual frames or a sequence of frames from multi-image streams (e.g., animated PAMs), making it a versatile tool for processing image animations. Output filenames are generated automatically based on a user-defined template specified with <I>-output</I>, allowing for flexible naming conventions incorporating sequential numbers or frame numbers. This utility is invaluable for tasks such as creating image sprites, tiling large images, or isolating frames from video-like image sequences.


title: CAVEATS
content:
When specifying both explicit dimensions (<I>-width</I>, <I>-height</I>) and a grid (<I>-cols</I>, <I>-rows</I>), the explicit dimensions will take precedence if they define a grid that fits the input image. If the input image dimensions are not exact multiples of the specified <I>-width</I> and <I>-height</I>, some output images might be smaller unless <I>-pad</I> is used.


title: INPUT/OUTPUT BEHAVIOR
content:
<I>pamsplit</I> adheres to the standard Netpbm pipeline philosophy. It can read image data from standard input (e.g., piped from another Netpbm command) or from a specified <I>inputfile</I>. Output images are written to individual files whose names are constructed based on the <I>-output</I> template, allowing for automated batch processing and organized file management.


title: FLEXIBLE SPLITTING MODES
content:
The command offers highly flexible splitting methods. Users can precisely define the size of each output chunk using <I>-width</I> and <I>-height</I> for fixed-size splits. Alternatively, for grid-based layouts, <I>-cols</I> and <I>-rows</I> divide the image into an equal number of horizontal and vertical sections. For multi-frame images, the <I>-frame</I>, <I>-frames</I>, and <I>-startframe</I> options enable precise control over frame extraction, making it suitable for animations or image sequences.


title: HISTORY
content:
<I>pamsplit</I> is a core utility within the Netpbm project, a comprehensive toolkit for manipulating graphic files. As part of Netpbm, its development is integrated into the larger suite's evolution, providing fundamental image splitting capabilities that have been refined over time as part of this venerable open-source project.


title: PARAMETERS
content:
<b><i>-horz</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Concatenates images horizontally instead of vertically. By default, images are stacked vertically.<br><br><b><i>netpbmfile</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies an input Netpbm image file. Multiple files can be listed. If <i>-</i> is used as a filename, <i>pamstack</i> reads from standard input. All input images must have the same width (or height if <i>-horz</i> is used), maxval, and tuple type.<br><br>


title: DESCRIPTION
content:
<i>pamstack</i> is a utility from the Netpbm image processing suite designed to vertically concatenate multiple Netpbm images into a single output image. It takes two or more input images, either specified by filename or read from standard input. A fundamental requirement for all input images is that they must possess identical widths, maximum color values (maxval), and tuple types (e.g., grayscale, RGB, RGB_ALPHA). The command outputs the combined image to standard output, making it easily pipeable to other Netpbm tools or redirected to a file. This function is particularly useful for creating vertical panoramas, assembling sequential image frames, or simply consolidating several smaller images into one larger, scrollable graphic. As part of Netpbm, <i>pamstack</i> adheres to the suite's philosophy of simple, atomic operations that can be chained together for complex image manipulations.


title: CAVEATS
content:
<i>pamstack</i> imposes strict requirements on its input images: all images must share identical widths (or heights when using the <b>-horz</b> option), the same maximum color value (maxval), and an identical tuple type (e.g., all grayscale, all RGB, all RGB_ALPHA). Failure to meet these criteria will result in an error and the command will terminate.


title: OUTPUT DESTINATION
content:
The resulting stacked image is always written to standard output. This design choice facilitates piping the output directly into other Netpbm utilities for further processing or redirecting it to a file using shell redirection.


title: HISTORY
content:
<i>pamstack</i> is a component of the comprehensive Netpbm image processing toolkit, which evolved from the PBMPlus package developed in the late 1980s. The command's functionality is very similar to, and in some contexts, considered interchangeable with, the <i>pamcat</i> utility. This overlap suggests that <i>pamstack</i> might represent an earlier iteration or a specialized variant of vertical/horizontal image concatenation within the Netpbm suite, likely developed around the time the flexible PAM format became a cornerstone of the library.


title: SYNOPSIS
content:
<b>pamstretch</b> [<i>-x x_factor</i>] [<i>-y y_factor</i>] [<i>-width width</i>] [<i>-height height</i>] [<i>-xwidth x_width</i>] [<i>-yheight y_height</i>] [<i>-linear</i> | <i>-bilinear</i> | <i>-cubic</i> | <i>-quadratic</i> | <i>-catrom</i>] [<i>-fill color</i>] [<i>-nomaxgray</i>] [<i>-time</i>] [<i>-verbose</i>]


title: PARAMETERS
content:
<b>-x <i>x_factor</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Stretches the image horizontally by the specified <i>x_factor</i>. For example, a factor of 2.0 doubles the width; 0.5 halves it.<br><br><b>-y <i>y_factor</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Stretches the image vertically by the specified <i>y_factor</i>. For example, a factor of 2.0 doubles the height; 0.5 halves it.<br><br><b>-width <i>width</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the target width of the output image in pixels. The height will be scaled proportionally to maintain the aspect ratio unless <i>-height</i> is also specified.<br><br><b>-height <i>height</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the target height of the output image in pixels. The width will be scaled proportionally to maintain the aspect ratio unless <i>-width</i> is also specified.<br><br><b>-xwidth <i>x_width</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the horizontal extent (radius) of the resampling filter in input pixels. Defaults vary by filter type (e.g., 3 for cubic, 2 for others). This is an advanced option for fine-tuning filter behavior.<br><br><b>-yheight <i>y_height</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the vertical extent (radius) of the resampling filter in input pixels. Similar to <i>-xwidth</i>, this is an advanced option for filter customization.<br><br><b>-linear</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses linear interpolation for resampling. This is the fastest filter but generally produces the lowest quality output, often leading to pixelated results when enlarging.<br><br><b>-bilinear</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses bilinear interpolation for resampling. This is the default filter and offers a good balance between processing speed and output quality for most common resizing tasks.<br><br><b>-cubic</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses cubic interpolation for resampling. This filter is slower than linear or bilinear but typically yields better quality, often resulting in sharper images with smoother transitions.<br><br><b>-quadratic</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses quadratic interpolation for resampling. Another advanced filter option, similar to cubic, providing varying quality characteristics for specific resizing needs.<br><br><b>-catrom</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses Catmull-Rom interpolation for resampling. This filter is known for producing sharper images, making it ideal when preserving crisp details is a priority, though it can sometimes introduce minor artifacts.<br><br><b>-fill <i>color</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a color to fill any new areas that become exposed due to stretching or when the filter extends beyond the original image boundaries. The <i>color</i> can be a recognized color name (e.g., "red") or a hexadecimal RGB value (e.g., "#FF0000").<br><br><b>-nomaxgray</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents <i>pamstretch</i> from scaling the maxval (maximum pixel value) of the output image. This option is typically for backward compatibility with older Netpbm tools and is rarely needed for modern usage.<br><br><b>-time</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reports the total time taken for the command execution to standard error, useful for performance monitoring.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints verbose information about the processing steps and progress to standard error, aiding in debugging or understanding command execution.<br><br>


title: DESCRIPTION
content:
<i>pamstretch</i> is a powerful command-line utility from the Netpbm suite, specifically engineered for the precise resizing and resampling of images. It functions as a filter, reading a Netpbm image (supporting PAM, PGM, PPM, and PNM formats) from standard input and subsequently writing the processed, resized image to standard output.<br><br>What distinguishes <i>pamstretch</i> from more basic scaling tools is its advanced suite of interpolation algorithms. Users can choose from methods such as linear, bilinear (the default), cubic, quadratic, and Catmull-Rom. Each algorithm offers a unique trade-off between processing speed and the visual quality of the output, allowing for fine control over how pixels are interpolated during the resizing process. Whether the goal is to scale an image by a specific factor or to target exact pixel dimensions, <i>pamstretch</i> provides the necessary versatility for a wide range of image manipulation tasks, ensuring quality while adapting to different scaling requirements.


title: CAVEATS
content:
The default filter extents (values for <i>-xwidth</i>, <i>-yheight</i>) for certain filters might have changed across different versions of <i>pamstretch</i> or Netpbm. Always refer to the specific man page for your installed version if encountering unexpected results.<br><br>For very simple integer scaling operations, <i>pamscale(1)</i> might offer faster performance, although <i>pamstretch</i> generally provides superior image quality due to its advanced resampling algorithms for non-integer or significant resizing.


title: INPUT/OUTPUT USAGE
content:
<i>pamstretch</i> is designed to operate as a filter program within a pipeline. This means it reads image data from its standard input (stdin) and writes the processed image data to its standard output (stdout). To use it effectively, you typically pipe image data to it from another command or redirect from a file, and then redirect its output to a new file or another command.<br><br><b>Example usage:</b><br><i>convert input.png pam:- | pamstretch -x 0.5 -y 0.5 > output.pam</i><br>or<br><i>cat input.pam | pamstretch -width 100 -height 100 > output_small.pam</i>


title: CHOOSING A FILTER
content:
The choice of resampling filter (e.g., <i>-linear</i>, <i>-bilinear</i>, <i>-cubic</i>, <i>-catrom</i>) significantly impacts the output image quality and processing speed:<br><br><i><b>-linear</b></i>: Fastest, lowest quality, often leads to pixelated or blocky results, especially when enlarging.<br><i><b>-bilinear</b></i> (default): A good balance between speed and quality, commonly used for general resizing. Offers smoother results than linear.<br><i><b>-cubic</b></i> / <i><b>-quadratic</b></i>: Slower than bilinear, but generally produce better quality, often resulting in sharper details and smoother gradients.<br><i><b>-catrom</b></i>: Tends to be the sharpest filter, ideal when preserving crispness is a priority, but it can sometimes introduce minor ringing artifacts.


title: HISTORY
content:
<i>pamstretch</i> was developed as an integral part of the Netpbm project, a comprehensive suite of graphics utilities with a long-standing history in Unix-like environments. It was specifically introduced to expand upon Netpbm's existing image manipulation capabilities by providing more advanced image resampling options, particularly through the inclusion of various interpolation algorithms. Its development addressed the need for greater control over image quality during resizing, augmenting Netpbm's already robust set of tools for processing graphic files.


title: SYNOPSIS
content:
<b>pamtofits</b> [<I>options</I>] [<I>input_pam_file</I>] <br><br>If <I>input_pam_file</I> is not specified, <b>pamtofits</b> reads from standard input. Output is always written to standard output.


title: PARAMETERS
content:
<b>-t <I>bitpix</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the number of bits per pixel for the FITS output. Common values include 8, 16, 32 (for integers) or -32, -64 (for floating point numbers).<br><br><b>-b <I>bscale</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the FITS BSCALE keyword, used for linear scaling of pixel values.<br><br><b>-z <I>bzero</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the FITS BZERO keyword, used as an offset for pixel values in combination with BSCALE.<br><br><b>-e <I>extname</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the FITS EXTNAME keyword for the image extension, providing a descriptive name for the HDU (Header Data Unit).<br><br><b>-H <I>header_file</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reads additional FITS header keywords from the specified <I>header_file</I> and includes them in the output FITS header.<br><br><b>-V <I>val_type</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the pixel value type, such as <I>unsigned_char</I>, <I>signed_short</I>, <I>float</I>, or <I>double</I>, influencing how pixel data is stored.<br><br><b>-q <I>quant_level</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Quantizes the data to a specific number of levels, useful for reducing file size or adapting data to specific FITS bit depths.<br><br><b>-v <I>verbose_level</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Controls the verbosity of output messages, with levels typically ranging from 0 (silent) to 3 (detailed debugging information).<br><br><b>-T</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Transposes the image data, effectively swapping the X and Y axes of the image.<br><br><b>-W</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses all warning messages that might be generated during the conversion process.<br><br><b>-N</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs a simple FITS primary header only, without any extensions or complex FITS structure, potentially improving compatibility with older FITS readers.<br><br>


title: DESCRIPTION
content:
<i>pamtofits</i> is a utility from the Netpbm project, a comprehensive toolkit for image manipulation. It specializes in converting images from the Portable Arbitrary Map (PAM) format to the Flexible Image Transport System (FITS) format. The PAM format is Netpbm's most versatile, supporting arbitrary-depth images and various color models. FITS, on the other hand, is a widely adopted standard in astronomy for storing scientific data, including images, spectra, and tables, designed for long-term archival and interoperability. <br><br> <i>pamtofits</i> reads a PAM image from standard input (or a specified file) and outputs the corresponding FITS image to standard output. This makes it an essential tool for astronomers and scientists who need to integrate Netpbm-processed images into their FITS-based workflows, ensuring proper data representation and adherence to the FITS standard.


title: CAVEATS
content:
FITS is primarily designed for scientific data; while <i>pamtofits</i> handles image data, complex scientific datasets might require more specialized FITS tools for full metadata integration.<br><br>The conversion fidelity depends on the input PAM image's characteristics. Not all PAM features map directly or optimally to FITS, and some transformations (e.g., color conversion, quantization) might result in data loss or alteration.<br><br>FITS files, especially for high bit-depth or multi-dimensional data, can be very large. Ensure sufficient disk space and consider the implications for data transfer and storage.


title: INPUT/OUTPUT BEHAVIOR
content:
<i>pamtofits</i> typically reads its input PAM image from standard input if no file argument is provided. The resulting FITS image is always written to standard output. This design makes it highly suitable for use in shell pipelines, allowing chaining with other Netpbm utilities or command-line tools for complex image processing workflows.


title: FITS STANDARD COMPLIANCE
content:
The command strives to produce FITS files that are compliant with the FITS standard (currently FITS v4.0). Users working with specific FITS processors or requiring strict compliance should consult the FITS standard documentation and potentially use options like <b>-O</b> (Output standard FITS only) or <b>-N</b> (Simple FITS header) to ensure maximum compatibility with their target systems or applications.


title: HISTORY
content:
<i>pamtofits</i> is a component of the Netpbm suite of graphics utilities, which originated from the PBMPlus package by Jef Poskanzer in the late 1980s. PBMPlus laid the groundwork with the Portable Bitmap (PBM), Graymap (PGM), and Pixmap (PPM) formats. The Netpbm project expanded upon this, introducing the more flexible Portable Arbitrary Map (PAM) format to handle arbitrary depths, planes, and transparency.<br><br>The development of <i>pamtofits</i> specifically addresses the need to bridge Netpbm's general image processing capabilities with the specialized requirements of the FITS format, a cornerstone in astronomical and scientific imaging. It allows researchers to leverage Netpbm's extensive tools for image manipulation and then seamlessly convert their data into a FITS-compliant format for analysis and archival, effectively superseding older, less capable converters like <i>pnmtofits</i>.


title: SYNOPSIS
content:
pamtogif [-transparent color] [-onwhite] [-interlace] [-comments "text"] [-verbose] [<i>pamfile</i>]


title: PARAMETERS
content:
<b>-transparent color</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a color to be made transparent in the output GIF. The <i>color</i> can be an exact RGB hexadecimal value (e.g., #FF0000), a standard color name (e.g., 'red', 'light blue'), or the keyword 'exact' to use the exact color value if it already exists in the image's colormap.<br><br><b>-onwhite</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Primarily for black and white (PBM) inputs, this option sets white as the foreground color and black as the background. By default, <i>pamtogif</i> treats black as foreground and white as background.<br><br><b>-interlace</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Generates an interlaced GIF, allowing web browsers or viewers to progressively display the image as it downloads, rather than waiting for the entire image to load.<br><br><b>-comments "text"</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adds a GIF comment block containing the specified <i>text</i> string to the output GIF file. This can be useful for embedding metadata or descriptions.<br><br><b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, causing <i>pamtogif</i> to print informative messages about the conversion process, such as color reduction statistics or processing steps.<br><br><b>pamfile</b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input PAM image file. If this argument is omitted, <i>pamtogif</i> reads image data from standard input (stdin).<br><br>


title: DESCRIPTION
content:
<i>pamtogif</i> is a powerful command-line utility from the Netpbm toolkit, designed to convert Portable Arbitrary Map (PAM) image files into the popular Graphics Interchange Format (GIF). It's a versatile tool that handles various PAM subtypes, including grayscale, RGB, RGBA (with alpha channel), and black and white, converting them efficiently to the GIF format's indexed color palette. <br><br>The command automatically performs color quantization if the input PAM image contains more than 256 colors, ensuring compatibility with the GIF specification while striving to maintain visual quality. It supports advanced GIF features like transparency, allowing a specified color to be rendered as transparent, and interlacing, which enables progressive display of the image as it downloads. <br><br>Users can also add descriptive comments directly into the GIF file's metadata. As with most Netpbm tools, <i>pamtogif</i> is designed to work seamlessly with pipes, reading input from standard input and writing output to standard output by default, making it an essential component in complex image processing workflows.


title: CAVEATS
content:
GIF images are limited to a maximum of 256 colors. If the input PAM image has more colors, <i>pamtogif</i> will perform color quantization to reduce the palette, which may result in some loss of color fidelity. This command does not support generating animated GIFs; it produces static GIF images only.


title: COLOR QUANTIZATION
content:
When an input PAM image contains more than the 256 colors permissible in the GIF format, <i>pamtogif</i> automatically applies a color quantization algorithm. This process reduces the number of unique colors to fit the GIF palette while attempting to preserve as much visual information as possible. The quality of the quantization can vary depending on the image's original color complexity.


title: STANDARD INPUT/OUTPUT
content:
By default, <i>pamtogif</i> is designed to operate within a Unix pipeline. It reads the input PAM image data from standard input (stdin) if no <i>pamfile</i> argument is provided, and it writes the resulting GIF image data to standard output (stdout). This allows for seamless integration with other command-line tools.


title: HISTORY
content:
<i>pamtogif</i> is a key component of the Netpbm image processing toolkit, a collection of graphics programs that have been a staple in Unix-like environments for decades. It was developed to supersede older, less generalized tools like <i>pbmtogif</i>, providing a unified and more powerful solution for converting various Portable Anymap (PAM) formats to GIF. Its design reflects the Netpbm philosophy of small, specialized tools that can be chained together in pipelines, enabling complex image manipulations through simple command combinations.


title: SYNOPSIS
content:
pamtopam [<I>netpbmfile</I>] [<B>-alphaok</B>] [<B>-alphanotok</B>] [<B>-bytedepth</B>] [<B>-check</B>] [<B>-depth=</B><I>depth</I>] [<B>-noalphaplain</B>] [<B>-plain</B>] [<B>-tupletype=</B><I>tupletype</I>] [<B>-verbose</B>] <br> <I>The input file is read from standard input if not specified, and output is written to standard output.</I>


title: PARAMETERS
content:
<b><b>-alphaok</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the input has an alpha channel, preserve it. If not, add a full-opacity alpha channel to the output.<br><br><b><b>-alphanotok</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;If the input has an alpha channel, remove it from the output. If it doesn't, do nothing.<br><br><b><b>-bytedepth</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output image's depth (maxval) to be a multiple of 8 bits, converting if necessary.<br><br><b><b>-check</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Performs consistency checks on the input and output data during processing.<br><br><b><b>-depth=</b><I>depth</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the maximum pixel value (maxval) for the output PAM image to the specified <I>depth</I>.<br><br><b><b>-noalphaplain</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Writes the output in plain (ASCII) format, but only if no alpha channel is present in the image.<br><br><b><b>-plain</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output to be in plain (ASCII) format, which is human-readable but larger than raw format.<br><br><b><b>-tupletype=</b><I>tupletype</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the tuple type of the output PAM image to <I>tupletype</I> (e.g., "RGB", "GRAYSCALE", "RGB_ALPHA", "BLACKANDWHITE").<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages about the processing steps to standard error.<br><br>


title: DESCRIPTION
content:
pamtopam is a Netpbm program that reads an image in any of the Netpbm formats (PBM, PGM, PPM, or PAM) and writes it out in the PAM (Portable Arbitrary Map) format. Its primary use is to ensure an image is in the versatile PAM format, which supports arbitrary tuple types and depths, making it suitable for more complex image processing operations. It can also be used to change certain properties of an existing PAM image, such as its depth or tuple type, or to normalize its representation. For example, it can convert a PBM (monochrome) or PPM (color) image into a PAM image, preserving or modifying aspects like transparency channels or color depth based on the specified options.


title: CAVEATS
content:
pamtopam converts to the general PAM format. For specific conversions to PBM, PGM, or PPM, consider using anytopnm. <br> Using the <b>-depth</b> option to decrease depth can lead to loss of image precision. Conversely, increasing depth does not add more information but can increase file size. <br> The <b>-plain</b> option results in significantly larger output files compared to the default raw format, especially for large images.


title: STANDARD INPUT/OUTPUT
content:
pamtopam typically reads its input image from standard input if no file argument is provided, and writes the resulting PAM image to standard output. This design allows it to be easily integrated into pipelines with other Netpbm tools or standard Unix commands for chained image processing.


title: PAM FORMAT VERSATILITY
content:
The Portable Arbitrary Map (PAM) format is designed to be highly flexible, supporting various pixel depths (bits per sample) and tuple types (e.g., grayscale, RGB, RGB with alpha, CMYK, etc.). pamtopam leverages this versatility by allowing users to specify desired output characteristics, making it a foundational tool for complex Netpbm image operations.


title: HISTORY
content:
pamtopam is a component of the Netpbm package, a suite of graphics utilities dating back to the late 1980s. The PAM (Portable Arbitrary Map) format itself was introduced later in Netpbm's development to provide a more flexible and extensible image format compared to the older PBM, PGM, and PPM formats, which were limited in their support for different pixel depths, tuple types (e.g., transparency), and arbitrary data. pamtopam was developed to facilitate conversions into and manipulations of this newer, more versatile PAM format.


title: SYNOPSIS
content:
<b>pamtopbm</b> [<I>options</I>] [<I>pamfile</I>]<br><br>Example: <b>pamtopbm</b> <I>input.pam</I> > <I>output.pbm</I><br>Example with dithering: <b>pamtopbm</b> <I>-dither</I> <I>colorimage.pam</I> | <I>pbmtopng</I> > <I>bw_image.png</I>


title: PARAMETERS
content:
<b>-threshold</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Uses simple thresholding to convert to black and white. This is the default behavior if no conversion method is explicitly specified. Pixels are assigned black or white based on a single cutoff value.<br><br><b>-dither</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Applies Floyd-Steinberg dithering for conversion. This method distributes quantization errors to neighboring pixels, creating a more visually faithful monochrome representation, particularly effective for images with gradients or smooth tones.<br><br><b>-floyd</b><br>&nbsp;&nbsp;&nbsp;&nbsp;An alias for <I>-dither</I>, also applying Floyd-Steinberg dithering.<br><br><b>-fs-dither</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Another alias for <I>-dither</I>, specifically naming the Floyd-Steinberg dithering algorithm.<br><br><b>-value=<I>number</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the threshold value for the <I>-threshold</I> option. <I>number</I> is a floating-point value between 0.0 and 1.0, representing the fraction of the maximum pixel value. The default threshold is 0.5.<br><br><b>-color=<I>color</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines which color from the input image should be treated as 'black' in the output PBM. <I>color</I> can be a color name (e.g., 'blue') or a hexadecimal triplet (e.g., '#0000FF'). Useful for specific color-to-monochrome mappings.<br><br><b>-transparent=<I>color</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Similar to <I>-color</I>, but defines which color from the input is considered 'white' (or transparent) for the output PBM. <I>color</I> can be a color name or hexadecimal triplet.<br><br><b><I>pamfile</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input PAM file to be converted. If this argument is omitted, `<b>pamtopbm</b>` reads the PAM image data from standard input.<br><br>


title: DESCRIPTION
content:
`<b>pamtopbm</b>` is a fundamental utility within the Netpbm image processing suite. Its primary function is to convert a Portable Arbitrary Map (PAM) image into a Portable Bitmap (PBM) image. PBM is a monochrome (black and white) image format. When the input PAM image contains colors or shades of gray, `<b>pamtopbm</b>` must perform a conversion to a two-color (black and white) representation.<br><br>By default, it employs a simple thresholding method, where pixel values below half of the maximum intensity are converted to black, and all others to white. For a more nuanced and visually accurate conversion, especially for images with gradients, the command supports various dithering algorithms, notably the widely used Floyd-Steinberg dithering. If the input PAM is already a black and white image, `<b>pamtopbm</b>` efficiently copies it without modification, acting as a pass-through. It is an essential tool for reducing image complexity to its simplest binary form, often used as an intermediate step in larger image processing pipelines.


title: CAVEATS
content:
The quality of the monochrome conversion largely depends on the chosen method. Simple thresholding (the default) can result in significant loss of detail and harsh transitions, especially in images with subtle gradients. Dithering methods, while generally producing superior visual results by simulating shades of gray, can introduce a 'noisy' or patterned appearance. The <I>-color</I> and <I>-transparent</I> options are most effective for input images with clear, distinct colors; their behavior with complex, highly varied color inputs might not always be intuitive.


title: NETPBM PHILOSOPHY
content:
Netpbm tools, including `<b>pamtopbm</b>`, are designed as 'universal translators' that operate on image data streams. This modular design encourages piping commands together (e.g., `command1 | command2 | command3`) to build complex image manipulations from simple, focused operations, enhancing flexibility and reusability across the suite.


title: INPUT/OUTPUT STREAM
content:
Consistent with Netpbm conventions, if no input file is specified as an argument, `<b>pamtopbm</b>` reads the image data from standard input. Similarly, the resulting PBM image is written to standard output. This design facilitates seamless integration into shell pipelines for automated image processing workflows.


title: HISTORY
content:
`<b>pamtopbm</b>` was introduced into the Netpbm package with release 10.32 in March 2006. Its functionality was previously integrated into the more general `pnmtopbm` command, which handled conversions from various Portable Anymap (PNM) formats to PBM. The creation of `<b>pamtopbm</b>` as a dedicated utility specifically for the Portable Arbitrary Map (PAM) format aligns with Netpbm's design philosophy of providing specialized converters for specific format pairs, enhancing modularity and clarity.


title: SYNOPSIS
content:
<b>pamtopng</b> [ <I>options</I> ] [ <I>pamfile</I> ]<br><br>Input is from <I>pamfile</I> or standard input if <I>pamfile</I> is not specified. Output is always to standard output.


title: PARAMETERS
content:
<b>-verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints informative messages about the conversion process to standard error.<br><br><b>-transparent=<I>color</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a color in the input image to be treated as transparent in the PNG output. The <I>color</I> can be specified as a hexadecimal RGB value (e.g., #RRGGBB, #RRRGGGBBB) or by a color name found in the <I>rgb.txt</I> file.<br><br><b>-gamma=<I>value</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the gamma value for the PNG image. This value is included in the PNG's <I>gAMA</I> chunk. The default gamma value used is 2.2.<br><br><b>-text</b><br>&nbsp;&nbsp;&nbsp;&nbsp;This option is provided for compatibility with <I>pnmtopng</I> but has no effect in <b>pamtopng</b>, as it does not have facilities to set text chunks within the PNG file. For adding text chunks, consider using <I>pnmtopng</I> instead.<br><br><b>-alpha</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output PNG to include an alpha channel. If the input PAM image does not inherently have an alpha channel, an opaque alpha channel will be added.<br><br><b>-background=<I>color</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the background color for transparent pixels in the PNG image, which is stored in the PNG's <I>bKGD</I> chunk. The <I>color</I> format is the same as for the <I>-transparent</I> option.<br><br><b>-compression=<I>level</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Defines the Zlib compression level used for the PNG data, ranging from 0 (no compression) to 9 (maximum compression). The default level is typically determined by the <i>libpng</i> library, often 6.<br><br><b>-interlace</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Creates an interlaced PNG image using the Adam7 algorithm. Interlaced PNGs can be displayed progressively as they load.<br><br><b>-force</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces <b>pamtopng</b> to proceed with operations that it might otherwise consider problematic or inefficient, such as producing a very large indexed PNG or an indexed PNG when input tuple type implies it must be indexed.<br><br>


title: DESCRIPTION
content:
<b>pamtopng</b> reads a PAM (Portable Arbitrary Map) image from its input and produces a PNG (Portable Network Graphics) image as output. PAM is the flexible, generalized image format used by the Netpbm image processing tools, capable of representing various pixel types (e.g., RGB, RGBA, grayscale, grayscale with alpha) and arbitrary bit depths.<br><br>The command typically reads the PAM input from standard input (or a specified file) and writes the PNG output to standard output, making it suitable for use in shell pipelines. It leverages the underlying <i>libpng</i> library for efficient PNG creation.<br><br>While <b>pamtopng</b> can be invoked directly by users, it is often utilized as an intermediary step within larger image manipulation workflows, seamlessly handling different PAM tuple types and 'maxval' (maximum pixel value) to generate appropriate PNG outputs, including proper handling of alpha channels when present in the source PAM data.


title: CAVEATS
content:
The <I>-text</I> option in <b>pamtopng</b> is a no-op; it does not add text chunks to the PNG. Users requiring text chunks should consider using the <I>pnmtopng</I> command, which offers this functionality.<br><br>Since <b>pamtopng</b> writes to standard output, it is almost always used with output redirection (e.g., <I>&gt; output.png</I>) or as part of a pipeline.


title: PAM FORMAT CONTEXT
content:
PAM (Portable Arbitrary Map) is a highly flexible, generalized image format fundamental to the Netpbm suite. Unlike the simpler PBM, PGM, and PPM formats, PAM can represent any type of pixel (tuple) and bit depth, making it an ideal intermediate format for diverse image processing operations within the Netpbm environment.


title: STANDARD INPUT/OUTPUT USAGE
content:
By default, <b>pamtopng</b> reads its PAM input from standard input and writes the resulting PNG image to standard output. This design promotes its use in command-line pipelines, allowing it to seamlessly integrate with other Netpbm tools or Unix utilities.


title: PARAMETERS
content:
<b><b>-force-color</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output to be in PPM (Portable PixMap) format, even if the input PAM could be represented as grayscale or black and white. Missing color planes are filled with zeros (black).<br><br><b><b>-force-grayscale</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output to be in PGM (Portable GreyMap) format. If the input PAM is color, it is converted to grayscale using standard Netpbm luminance conversion.<br><br><b><b>-force-blackandwhite</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the output to be in PBM (Portable BitMap) format. Grayscale or color input PAMs are converted to black and white.<br><br><b><b>-plain</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs the resulting image in the plain (ASCII) Netpbm format rather than the default raw (binary) format. Plain formats are human-readable but larger.<br><br><b><b>-color-range=<i>maxval</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a new <i>maxval</i> for the output PGM or PPM image. The pixel values from the input PAM are scaled to fit this new maximum value.<br><br><b><b>-fix-float</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(Netpbm 10.95+) Converts PAM images with floating-point samples to integer samples suitable for PBM, PGM, or PPM output. This is necessary for such PAMs, as PBM/PGM/PPM do not support floating-point values.<br><br><b><b><i>pamfile</i></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input PAM image file. If omitted, <i>pamtopnm</i> reads from standard input (stdin).<br><br>


title: DESCRIPTION
content:
<i>pamtopnm</i> is a utility from the Netpbm image processing toolkit that converts a Portable Arbitrary Map (PAM) image into one of the simpler Portable BitMap (PBM), Portable GreyMap (PGM), or Portable PixMap (PPM) formats.<br><br>The PAM format is a more general Netpbm format designed to handle various kinds of image data, including multiple channels (e.g., alpha, CMYK) and arbitrary depth, which are not directly supported by the older PBM/PGM/PPM formats. <i>pamtopnm</i> acts as a crucial bridge, reducing a generic PAM to a conventional PBM, PGM, or PPM image.<br><br>It automatically determines the most appropriate output format based on the input PAM's characteristics: a black and white PAM becomes PBM, a grayscale PAM becomes PGM, and a color PAM becomes PPM. Users can also explicitly force a specific output format using command-line options, for instance, to convert a color PAM to grayscale PGM.


title: CAVEATS
content:
<i>pamtopnm</i> expects a valid PAM format as input. If the input PAM contains data types or channels that cannot be meaningfully represented in PBM, PGM, or PPM (e.g., specific non-image data), conversion might result in data loss or an invalid output. Explicitly forcing a format (e.g., forcing color to black and white) will result in information loss.<br><br>Floating-point PAMs require the <b>-fix-float</b> option for proper conversion to integer-based PBM/PGM/PPM formats.


title: AUTOMATIC FORMAT DETERMINATION
content:
By default, <i>pamtopnm</i> intelligently determines the most suitable output format: it converts to PBM for 1-bit deep black and white PAMs, to PGM for grayscale PAMs (depth 1 or more), and to PPM for color PAMs (depth 3 or more). This auto-detection makes it very convenient for general use within image processing pipelines.


title: PIPELINE USAGE
content:
Due to its design, <i>pamtopnm</i> is frequently used in Unix-style pipelines. For example, to convert a PNG image to a grayscale PGM:<br><code>pngtopam &lt; image.png | pamtopnm -force-grayscale &gt; image.pgm</code><br>This allows for powerful and flexible image manipulations by chaining multiple Netpbm utilities.


title: HISTORY
content:
<i>pamtopnm</i> is an integral part of the Netpbm image processing toolkit. Netpbm originated from Jef Poskanzer's Pbmplus package, developed in the late 1980s. The Portable Arbitrary Map (PAM) format itself was introduced later in Netpbm's development to provide a more flexible and extensible intermediate format, capable of representing more complex image types (like alpha channels, multi-spectral data, or floating-point samples) than the original PBM, PGM, and PPM formats. <i>pamtopnm</i> was created to bridge this gap, allowing PAM images to be converted back into the simpler, widely compatible Netpbm formats for further processing or display by tools that don't yet understand PAM directly.


title: PARAMETERS
content:
<b><b>-output</b> <I>file</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the path for the output QOI image file. If this option is omitted, the converted QOI data will be written to standard output (stdout).<br><br><b><b>-o</b> <I>file</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;A shorter alias for <b>-output</b>, specifying the output QOI image file.<br><br><b><b><I>input_file</I></b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The path to the input Netpbm PAM image file. If no input file is specified, <i>pamtoqoi</i> will read image data from standard input (stdin).<br><br><b><b>-help</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a brief usage message and exits.<br><br><b><b>-version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays version information for the command and exits.<br><br>


title: DESCRIPTION
content:
<i>pamtoqoi</i> is a hypothetical command-line utility designed to convert image data from the Netpbm PAM format (Portable Arbitrary Map) into the Quite OK Image (QOI) format.<br><br>The Netpbm formats (PPM for color, PGM for grayscale, PBM for monochrome, and PAM for arbitrary samples) are widely used in Unix-like environments as intermediate steps in image processing pipelines. QOI, introduced in 2021, is a modern, simple, and fast lossless image compression format known for its ease of implementation and high performance compared to formats like PNG for certain applications.<br><br>This command would facilitate the transition of image assets from traditional Netpbm workflows to systems or applications that benefit from QOI's characteristics. It operates by reading PAM data from standard input or a specified file and writing the resulting QOI image to standard output or a designated output file, adhering to common Unix utility design principles.


title: CAVEATS
content:
As <i>pamtoqoi</i> is a hypothetical command, its actual existence and functionality depend on specific implementations. Users should verify its availability and precise behavior on their system. The QOI format, while efficient, may not be universally supported by all image viewing software or applications compared to more established formats like PNG or JPEG. Ensure the input PAM data is correctly formatted; malformed input could lead to conversion errors or corrupted output QOI files.


title: PIPING AND WORKFLOW INTEGRATION
content:
One of the primary strengths of Unix-like command-line tools like the hypothetical <i>pamtoqoi</i> is their ability to work seamlessly with pipes. This allows for flexible and powerful image processing workflows. For instance, an image in an unsupported format could be converted to PAM first, then piped directly to <i>pamtoqoi</i> for conversion to QOI: <br><code><b>anytoppm</b> <I>input.any</I> | <b>pamtoqoi</b> > <I>output.qoi</I></code><br>This eliminates the need for intermediate files, enhancing efficiency and scriptability.


title: HISTORY
content:
The concept of <i>pamtoqoi</i> arises from the emergence of the Quite OK Image (QOI) format in 2021 as a fast and simple alternative to more complex lossless image formats. Given the long-standing role of Netpbm utilities in Unix-like systems for image manipulation, a converter like <i>pamtoqoi</i> would naturally fill a niche, allowing integration of the new QOI format into existing Netpbm-centric workflows. Its development would likely stem from projects aiming to expand Netpbm's output capabilities or standalone initiatives driven by the QOI community.


title: PARAMETERS
content:
<b>-h, --help</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a concise help message and exits.<br><br><b>-v, --version</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Shows the command's version information and exits.<br><br><b>-V, --verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, displaying detailed progress and debugging information during conversion.<br><br><b>-q <quality>, --quality=<quality></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the output SRF image quality. Value typically ranges from 0 (lowest) to 100 (highest), affecting compression.<br><br><b>-s <scale>, --scale=<scale></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Scales the output image dimensions. A value of 1.0 means no scaling, 0.5 halves dimensions, 2.0 doubles them.<br><br><b>-o, --overwrite</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces overwriting of the output file if it already exists, without prompting.<br><br><b>-f <format>, --format=<format></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a sub-format or encoding within the SRF standard (e.g., 'lossless', 'huffman', 'jpeg-like').<br><br>


title: DESCRIPTION
content:
The <i>pamtosrf</i> command is a <b>hypothetical</b> utility designed for converting image data from the Portable Arbitrary Map (PAM) format to a specialized Structured Raster Format (SRF). PAM, part of the Netpbm tools, is a flexible format capable of representing various types of pixel maps, including grayscale, RGB, and multi-channel images, with arbitrary depth.<br><br>While <i>pamtosrf</i> is not a standard Linux command, if it existed, its primary function would be to facilitate interoperability between systems that use PAM for intermediate image processing and those requiring data in the SRF format. It would likely support various transformation options during conversion, such as scaling, quality adjustment, and verbose output for debugging. Its design would focus on robust error handling and efficient processing of potentially large image datasets, making it suitable for scripting in automated image processing pipelines or scientific data analysis workflows.


title: CAVEATS
content:
It is important to note that <i>pamtosrf</i> is a <b>hypothetical</b> command and does not exist as a standard utility in common Linux distributions. This analysis is based on a plausible design for such a conversion tool. If a real-world command with this name were encountered, its functionality might differ significantly. Users should verify its origin and purpose. Potential limitations for a real command could include large memory consumption for high-resolution images, lack of support for all PAM sub-formats, or performance issues on specific hardware.


title: HYPOTHETICAL USE CASES
content:
While <i>pamtosrf</i> is not a standard command, a tool with its proposed functionality would be valuable in scenarios requiring format conversion of image data. This includes:<br><br><i><b>Scientific Data Visualization:</b> Converting raw sensor data (represented as PAM) into a more structured format for specialized rendering software.<br><b>Automated Image Pipelines:</b> Integrating into scripts for batch processing of image directories, converting intermediate PAM files to a final output format.<br><b>Legacy System Interoperability:</b> Bridging modern image processing workflows with older systems that rely on the SRF format for input or output.</i>


title: PAM AND SRF FORMATS
content:
The <b>Portable Arbitrary Map (PAM)</b> format is a highly flexible image format from the Netpbm suite. It allows for arbitrary numbers of channels and depths, making it suitable for diverse image data beyond standard RGB.<br><br>The <b>Structured Raster Format (SRF)</b>, in this hypothetical context, represents a specialized or proprietary raster image format designed for specific applications, potentially optimized for storage, rendering, or specific hardware. Its structure would likely allow for efficient access to pixel data and metadata relevant to its intended use.


title: HISTORY
content:
As a hypothetical command, <i>pamtosrf</i> has no actual development history. However, if it were part of a real software suite, it might have originated as a specialized tool within a scientific imaging lab or a legacy system requiring a specific data format for processing or display. Its development could have been driven by the need to bridge the gap between general-purpose image manipulation tools (like Netpbm) and proprietary or niche systems using the 'SRF' format. Over time, it might have evolved to include more optimization options and support for different SRF encodings, reflecting advancements in image compression and processing techniques.


title: SYNOPSIS
content:
<b>pamtotga</b> [<<i>pamfile</i>>]<br><b>pamtotga</b> [<b>-alphacolor=</b><<i>color</i>>] [<<i>pamfile</i>>]


title: PARAMETERS
content:
<b><i>pamfile</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The input Portable Arbitrary Map (PAM) image file. If not specified, <b>pamtotga</b> reads from standard input (stdin).<br><br><b><b>-alphacolor=</b><<i>color</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies a background <i>color</i> to use for transparent pixels if the input PAM image has an alpha channel. The <i>color</i> can be specified as a hexadecimal RGB value (e.g., <i>#RRGGBB</i>) or a recognized color name. If omitted, the output TGA will typically retain the alpha channel.<br><br>


title: DESCRIPTION
content:
The <b>pamtotga</b> command is a crucial utility within the Netpbm image processing suite, designed specifically for converting images from the Portable Arbitrary Map (PAM) format to the Truevision Targa (TGA) format. PAM is Netpbm's generic pixelmap format, capable of representing a wide range of pixel data, including grayscale, color, and alpha channels. TGA, on the other hand, is a popular raster graphics format, widely used in video editing, 3D graphics, and game development due to its support for various bit depths and an optional alpha channel.<br><br>When <b>pamtotga</b> processes a PAM image, it reads the pixel data, colorspace, and alpha channel information, then translates it into a TGA file structure. If the input PAM contains an alpha channel, <b>pamtotga</b> typically produces a 32-bit TGA image that preserves this transparency. Users can also specify a background color for transparent areas using the <i>-alphacolor</i> option, which can be useful when compatibility with older TGA viewers or specific visual requirements are paramount. This command is often used as part of a larger pipeline, where an image is first converted to PAM for manipulation and then to TGA for final output or use in other applications.


title: CAVEATS
content:
<ul><li><b>pamtotga</b> focuses primarily on image data conversion and does not support TGA-specific features like image origin or gamma correction.</li><li>While TGA supports RLE compression, <b>pamtotga</b> usually outputs uncompressed TGA files. For compressed output, an external tool might be needed after conversion.</li><li>The <i>-alphacolor</i> option is only relevant if the input PAM image actually contains an alpha channel; otherwise, it is ignored.</li></ul>


title: STANDARD I/O USAGE
content:
Like most Netpbm commands, <b>pamtotga</b> operates as a filter. If no input <i>pamfile</i> is specified, it reads the PAM image data from standard input (stdin) and writes the resulting TGA image to standard output (stdout). This design facilitates its use in pipelines, combining multiple Netpbm utilities for complex image transformations.


title: ALPHA CHANNEL HANDLING
content:
The Targa format can support an alpha (transparency) channel. When <b>pamtotga</b> converts a PAM image with an alpha channel, it typically generates a 32-bit TGA file that includes this alpha information. This allows the converted image to maintain its transparency when used in applications that support 32-bit TGA. The <i>-alphacolor</i> option offers a way to 'flatten' this transparency against a solid background color if a 24-bit TGA or specific visual effect is desired.


title: HISTORY
content:
<b>pamtotga</b> is an integral part of the Netpbm project, a long-standing and widely used toolkit for image manipulation. The Netpbm suite originated from the Pbmplus package in the late 1980s, which introduced the Portable Bitmap (PBM), Portable Graymap (PGM), and Portable Pixmap (PPM) formats. The more flexible Portable Arbitrary Map (PAM) format, which <b>pamtotga</b> processes, was introduced later as a superset of the earlier formats, allowing for arbitrary numbers of channels and bit depths, including alpha transparency. <b>pamtotga</b> was developed to provide robust conversion capabilities to the Targa format, leveraging PAM's comprehensive data representation for seamless image pipeline integration, ensuring compatibility between Netpbm's internal processing and external applications requiring TGA input.


title: SYNOPSIS
content:
<b>pamtotiff</b> [<i>options</i>] [<i>pamfile</i>]<br>Reads a PAM image from <i>pamfile</i> (or standard input if not specified) and writes a TIFF image to standard output.


title: PARAMETERS
content:
<b><b>-deflate</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use Deflate (ZIP) compression. This is a common and generally effective lossless compression.<br><br><b><b>-packbits</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use PackBits compression. Often effective for images with large areas of single color.<br><br><b><b>-lzw</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use LZW compression. A widely supported lossless compression method.<br><br><b><b>-jpeg</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use JPEG compression. A lossy compression method, suitable for photographic images. Note: Not all TIFF readers support JPEG compressed TIFFs.<br><br><b><b>-g3</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use CCITT Group 3 fax compression. Primarily for bilevel (black and white) images.<br><br><b><b>-g4</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use CCITT Group 4 fax compression. More efficient than Group 3 for bilevel images, also primarily for black and white.<br><br><b><b>-none</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Do not use any compression.<br><br><b><b>-rowsperstrip=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the number of rows per strip in the TIFF file to <i>N</i>. Affects how data is organized internally.<br><br><b><b>-offset=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the byte offset to the first Image File Directory (IFD) to <i>N</i>. Useful for specific TIFF structures.<br><br><b><b>-bigendian</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Write TIFF data in big-endian byte order.<br><br><b><b>-littleendian</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Write TIFF data in little-endian byte order. This is typically the default for PCs.<br><br><b><b>-color</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Force output to 24-bit RGB color, even if input is grayscale or black and white.<br><br><b><b>-grayscale</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Force output to 8-bit grayscale. Color input will be converted to grayscale.<br><br><b><b>-blackandwhite</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Force output to 1-bit black and white. Color or grayscale input will be thresholded.<br><br><b><b>-bitrgb</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Write 1-bit per component RGB. Requires a 3-channel input.<br><br><b><b>-bitrgbt</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Write 1-bit per component RGB with transparency. Requires a 4-channel input (RGB + alpha).<br><br><b><b>-alpha</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Preserve the alpha channel if present in the input PAM. Output will be RGBA.<br><br><b><b>-description=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF ImageDescription tag to <i>string</i>.<br><br><b><b>-datetime=</b><i>YYYY:MM:DD HH:MM:SS</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF DateTime tag. Format must be exactly as specified.<br><br><b><b>-scanner=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF Make tag, often used for scanner models, to <i>string</i>.<br><br><b><b>-artist=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF Artist tag to <i>string</i>.<br><br><b><b>-hostcomputer=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF HostComputer tag to <i>string</i>.<br><br><b><b>-copyright=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF Copyright tag to <i>string</i>.<br><br><b><b>-documentname=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF DocumentName tag to <i>string</i>.<br><br><b><b>-pagename=</b><i>string</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF PageName tag to <i>string</i>.<br><br><b><b>-pagenumber=</b><i>M</i>,<i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the TIFF PageNumber tag, where <i>M</i> is the current page and <i>N</i> is the total number of pages.<br><br><b><b>-xres=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the horizontal resolution of the image to <i>N</i> pixels per unit.<br><br><b><b>-yres=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the vertical resolution of the image to <i>N</i> pixels per unit.<br><br><b><b>-units=</b><i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set the resolution units (1=No absolute unit, 2=Inch, 3=Centimeter). Must be used with <b>-xres</b> and <b>-yres</b>.<br><br><b><b>-v</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display verbose information during processing.<br><br><b><b>-verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display verbose information during processing (alias for <b>-v</b>).<br><br>


title: DESCRIPTION
content:
<i>pamtotiff</i> is a utility from the Netpbm package that converts a Portable Arbitrary Map (PAM) image into a Tagged Image File Format (TIFF) file. The PAM format is Netpbm's most versatile image representation, capable of handling various pixel types, including color, grayscale, black-and-white, and images with an alpha channel. <i>pamtotiff</i> provides extensive control over the output TIFF properties, such as compression type (e.g., Deflate, LZW, JPEG, PackBits, Group 3/4 fax, or none), byte order, and various TIFF metadata tags like description, date, and artist. It also allows specifying the output color depth (color, grayscale, or black and white). This command is crucial in workflows where image processing is performed using Netpbm tools, and the final output needs to be in the widely supported TIFF format for archiving, printing, or compatibility with other applications. It can read PAM data from standard input and write TIFF data to standard output, facilitating its use in shell pipelines.


title: CAVEATS
content:
When using JPEG compression (<b>-jpeg</b>), be aware that the output TIFF file might not be compatible with all older or less robust TIFF readers, as JPEG compression within TIFF is an optional feature. CCITT Group 3 and Group 4 compressions (<b>-g3</b>, <b>-g4</b>) are designed specifically for bilevel (black and white) images; using them with color or grayscale input will result in a binarized output. If your input PAM image is not in a suitable format, you might need to use other Netpbm utilities like <b>anytopam</b> or <b>tifftopam</b> to convert it first. Transparency handling can be complex; ensure the target application supports TIFF with alpha channels if you use the <b>-alpha</b> option.


title: INPUT AND OUTPUT
content:
By default, <i>pamtotiff</i> reads the PAM image data from standard input if no <i>pamfile</i> argument is provided. The resulting TIFF image is always written to standard output. This behavior makes it highly effective for use in shell pipelines, allowing it to seamlessly integrate with other commands that output PAM data or consume TIFF data.


title: INTEGRATION WITH NETPBM
content:
As a member of the Netpbm family, <i>pamtotiff</i> is designed to work in conjunction with other Netpbm utilities. You can often pipe the output of an image processing command (e.g., from <b>pamscale</b>, <b>pamflip</b>) directly into <i>pamtotiff</i> to convert the final processed image to TIFF format. Conversely, you might use <b>anytopam</b> or <b>tifftopam</b> to convert an image to PAM before passing it to other Netpbm manipulators.


title: HISTORY
content:
<i>pamtotiff</i> is an integral part of the Netpbm image manipulation suite, which originated from the PBMplus toolkit created by Jef Poskanzer in the late 1980s. Netpbm has evolved to become a foundational set of command-line tools for image conversion and processing on Unix-like systems. The Portable Arbitrary Map (PAM) format itself was introduced into Netpbm to provide a more flexible and generalized image format than the older PBM, PGM, and PPM formats, allowing for features like arbitrary sample depths and alpha channels. <i>pamtotiff</i> was developed to bridge this powerful internal PAM representation with the widely used and standardized TIFF format, supporting a variety of TIFF features and compression methods to meet diverse output requirements. Its design emphasizes pipeline compatibility, a core philosophy of the Netpbm project.


title: SEE ALSO
content:
<b>pnm(5)</b>, <b>pam(5)</b>, <b>anytopam(1)</b>, <b>pnmtotiff(1)</b>, <b>pamtogif(1)</b>, <b>tifftopam(1)</b>, <b>tiffinfo(1)</b>


title: PARAMETERS
content:
<b><b>-c</b>, <b>--clean</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Performs a gentle cleanup of temporary files, old log entries, and expired cache data. This option aims to free up disk space and remove transient clutter.<br><br><b><b>-o</b>, <b>--optimize</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Optimizes common system caches and file system structures to improve data access speeds and overall system responsiveness. This might include reindexing or defragmentation where appropriate for the underlying filesystem.<br><br><b><b>-v</b>, <b>--verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Increases verbosity, showing detailed information about files being processed, optimizations performed, and overall progress. Use multiple <b>-v</b> for even more detail.<br><br><b><b>-f</b>, <b>--force</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces <I>pamtouil</I> to proceed with operations that might otherwise require confirmation or be skipped due to safety checks. Use with caution.<br><br><b><b>-d</b>, <b>--dry-run</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Simulates the actions without making any actual changes to the system. This allows users to preview what <I>pamtouil</I> would do before committing to the changes, ensuring no unintended consequences.<br><br><b><b>-s</b>, <b>--summary</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Provides a brief, high-level summary of the operations performed and resources freed or optimized, rather than detailed per-file output.<br><br><b>[<I>TARGET</I>]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the scope of the operation. Common targets include <b>all</b> (for system-wide comfort), or specific paths like <b>/tmp</b>, <b>/var/cache</b>, or a user's home directory (<b>~/</b>). If omitted, <I>pamtouil</I> defaults to a general system comfort routine.<br><br>


title: DESCRIPTION
content:
<I>pamtouil</I> is a hypothetical system utility designed to maintain optimal system comfort and tidiness. It performs gentle, non-disruptive operations to clean up temporary files, optimize common system caches, and ensure overall system fluidity. Unlike aggressive cleaning tools, <I>pamtouil</I> focuses on enhancing the user experience by reducing system sluggishness and preventing the accumulation of digital clutter that can lead to 'system discomfort'. It's envisioned as a preventative maintenance tool, intended to be run periodically to keep the system feeling 'pampered' and responsive. <I>pamtouil</I> aims to achieve a harmonious balance between performance and stability, offering various modes of operation from a simple cleanup to a more comprehensive optimization, all while providing clear feedback on its actions. Its design philosophy centers on being unobtrusive and intelligent, learning over time what actions contribute most to system comfort without inadvertently affecting critical operations or user data.


title: CAVEATS
content:
As a hypothetical command, <I>pamtouil</I> does not exist in standard Linux distributions. If it were real, it would likely require root privileges (<b>sudo</b>) for most system-wide operations. Always use the <b>--dry-run</b> option before performing any significant cleaning or optimization. Incorrect usage could potentially affect system stability, though its design emphasizes gentleness.


title: <I>CONFIGURATION FILES</I>
content:
If <I>pamtouil</I> were a real command, it would likely use a configuration file, such as <b>/etc/pamtouil.conf</b>, to define default cleaning paths, optimization strategies, exclusion lists, and scheduling preferences. User-specific settings might reside in <b>~/.config/pamtouil/pamtouil.conf</b>.


title: <I>EXIT STATUS</I>
content:
<I>pamtouil</I> would ideally exit with a status of <b>0</b> upon successful completion of all requested operations. A non-zero exit status would indicate an error or partial failure, with specific codes potentially indicating the nature of the issue (e.g., permissions, invalid target, interrupted operation).


title: HISTORY
content:
The concept of <I>pamtouil</I> emerged from the theoretical needs of sysadmins who desired a more 'empathetic' system maintenance tool, beyond raw command-line utilities. Conceived in a playful thought experiment, its name is a whimsical blend suggesting 'pampering' and 'tidying'. Its 'development' focuses on a philosophy of user and system comfort, aiming to make Linux systems not just performant, but also 'happy' and 'comfortable' for their users, without the harshness often associated with system optimization scripts.


title: SYNOPSIS
content:
<i>pamtowinicon</i> [-alpha] [-output <i>filename</i>] [-sizes <i>width</i>x<i>height</i>[,<i>width</i>x<i>height</i>...]] [-colors <i>colorspec</i>[,<i>colorspec</i>...]] [<i>pbmfile</i>...]<br>OR<br><i>pamtowinicon</i> [-alpha] [-output <i>filename</i>] [-sizes <i>width</i>x<i>height</i>[,<i>width</i>x<i>height</i>...]] [-colors <i>colorspec</i>[,<i>colorspec</i>...]] < <i>input_pbm_file</i>


title: PARAMETERS
content:
<b>-alpha</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces output icon images to have an <b>alpha channel</b>, even if the input doesn't explicitly contain one. This is crucial for transparent icons.<br><br><b>-output <I>filename</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the output <b>.ICO</b> file name. If omitted, the icon data is written to standard output.<br><br><b>-sizes <I>width</I>x<I>height</I>[,<I>width</I>x<I>height</I>...]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;A comma-separated list of desired dimensions (e.g., <b>16x16</b>, <b>32x32</b>, <b>48x48</b>) for the icon entries. <i>pamtowinicon</i> will scale input images to these specified sizes.<br><br><b>-colors <I>colorspec</I>[,<I>colorspec</I>...]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;A comma-separated list of <b>color depth specifications</b>. <I>colorspec</I> can be <b>monochrome</b>, <b>16</b>, <b>256</b>, or <b>true</b>. This determines the color palette for each icon entry.<br><br>


title: DESCRIPTION
content:
<i>pamtowinicon</i> is a powerful utility from the <I>Netpbm</I> image processing toolkit. It enables the conversion of <I>Netpbm</I> format images (PAM, PNM, PBM, PGM, PPM) into a <b>Windows Icon (.ICO)</b> file. A key feature is its ability to embed multiple image representations within a single .ICO file, allowing the icon to display optimally at various sizes and color depths (e.g., 16x16, 32x32, 48x48 pixels with different color palettes). This is particularly useful for creating icons that adapt well to different display contexts, such as desktop shortcuts or web favicons.<br><br>The command can take one or more <I>Netpbm</I> files as input, each representing a different image layer for the icon, or it can process a single <I>Netpbm</I> file that contains multiple images. It provides options for specifying the desired sizes and color depths for the icon entries, offering flexibility in creating professional-quality icons.


title: CAVEATS
content:
The <I>Netpbm</I> input images should ideally be <b>square</b> and have appropriate dimensions for typical icon sizes to avoid significant distortion during scaling.<br><br>While <I>pamtowinicon</I> can create icons with <b>alpha channels</b>, older Windows versions or applications might not fully support them, potentially leading to a loss of transparency or display artifacts.


title: INPUT FORMAT FLEXIBILITY
content:
<I>pamtowinicon</I> can accept any <I>Netpbm</I> format (PBM, PGM, PPM, PAM) as input. If the input is not a PAM file, it is automatically converted to PAM internally before processing, ensuring full support for <b>alpha channels</b> and arbitrary depths.


title: BEST PRACTICES FOR ICON CREATION
content:
For optimal results, it's recommended to provide a high-resolution, square source image as input. Then, use the <I>-sizes</I> and <I>-colors</I> options to let <I>pamtowinicon</I> generate the various icon entries (e.g., 16x16, 24x24, 32x32, 48x48, 64x64, 128x128, 256x256) with appropriate color depths (e.g., <b>true</b> for larger sizes, <b>256</b> or <b>16</b> for smaller ones) from this single source. This ensures consistency across different icon sizes.


title: HISTORY
content:
<I>pamtowinicon</I> is part of the extensive <I>Netpbm</I> project, a suite of graphics utilities that originated in the early 1990s. The <I>Netpbm</I> toolkit is renowned for its modular design, where small, specialized programs perform specific image transformations. <I>pamtowinicon</I> was developed to address the specific need of converting general image formats into the proprietary <b>Windows Icon (.ICO)</b> format, enabling Linux and Unix users to create icons compatible with Windows environments without needing Windows-specific software. Its development reflects the <I>Netpbm</I> philosophy of providing versatile, command-line tools for a wide range of image manipulation tasks.


title: DESCRIPTION
content:
The <b>pamtoxvmini</b> command, part of the extensive Netpbm image manipulation toolkit, serves a specialized purpose: converting Portable Arbitrary Map (PAM) image files into the Xv miniature format. This output format is specifically designed for the <b>xv(1)</b> image viewer, a popular X11 application used for displaying and manipulating images. Xv miniature files are uncompressed bitmap images primarily utilized by <b>xv</b> for creating fast-loading thumbnails and previews, enhancing the viewer's responsiveness when browsing image directories.<br><br>The command reads a PAM image as its input, which can be specified as a filename argument or piped from standard input. Following the standard Netpbm philosophy, the converted Xv miniature data is then written to standard output, allowing for easy chaining with other Netpbm utilities or redirection to a file. While not a general-purpose image conversion tool for widely used formats, <b>pamtoxvmini</b> is invaluable for users who leverage the <b>xv</b> application and need to integrate PAM images into their <b>xv</b>-based workflows, particularly for efficient thumbnail generation.


title: CAVEATS
content:
The output Xv miniature format is highly specific to the <b>xv(1)</b> image viewer and is not a general-purpose or widely adopted image format for other applications. It is an uncompressed format, meaning the output file size can be relatively large compared to compressed formats like JPEG or PNG. Its primary utility is for generating <b>xv</b> thumbnails, not for broad image interoperability.


title: INPUT/OUTPUT HANDLING
content:
Following the standard Netpbm convention, if no input PAM file is specified as an argument, <b>pamtoxvmini</b> reads the image data from standard input. The converted Xv miniature data is always written to standard output. This design facilitates chaining <b>pamtoxvmini</b> with other Netpbm programs or shell commands using pipes ( | ) for complex image processing workflows.


title: XV MINIATURE FORMAT
content:
The Xv miniature format, while uncompressed, is optimized for quick loading by the <b>xv(1)</b> application. It essentially stores a downscaled, uncompressed version of the image suitable for rapid thumbnail generation, directly integrating with <b>xv</b>'s directory browsing features. It typically contains a low-resolution version of the image.


title: HISTORY
content:
<b>pamtoxvmini</b> is an integral component of the Netpbm project, an open-source graphics toolkit that traces its lineage back to the original Pbmplus package developed in the late 1980s. Netpbm evolved to include the more versatile Portable Arbitrary Map (PAM) format as a successor to the older PBM, PGM, and PPM formats, allowing for more complex pixel data and transparency. The development of <b>pamtoxvmini</b> was driven by the need to bridge the advanced capabilities of the PAM format with the specific requirements of the widely-used <b>xv(1)</b> image viewer, particularly for its efficient thumbnailing system. Its inclusion highlights Netpbm's commitment to supporting various image ecosystems and formats.


title: PARAMETERS
content:
<b><i>COMMAND</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;The action to perform. Common commands include <b>list</b>, <b>activate</b>, <b>deactivate</b>, <b>rollback</b>, <b>create</b>, and <b>delete</b>.<br><br><b>-l, --list</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Lists all available system profiles, along with their current status (active/inactive).<br><br><b>-a <profile>, --activate <profile></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Activates the specified system <i>profile</i>. This applies all configurations defined within the profile.<br><br><b>-d <profile>, --deactivate <profile></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Deactivates the specified system <i>profile</i>, reverting changes made by its activation, if possible.<br><br><b>-r <profile>, --rollback <profile></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Rollbacks the specified <i>profile</i> to its last known stable configuration or a previous snapshot. This requires profile versioning support.<br><br><b>-f, --force</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces the operation, overriding warnings or confirmations. Use with caution.<br><br><b>-v, --verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, showing detailed progress and actions taken by the command.<br><br><b>-h, --help</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the help message and exit.<br><br>


title: DESCRIPTION
content:
Please note: The command <i>pamundice</i> is a <b>fictional</b> Linux command created for this analysis, as no standard command with this name exists. This hypothetical utility is envisioned as a powerful system administration tool designed to manage and revert system-wide profiles and security configurations. It allows administrators to define, activate, deactivate, and rollback complex sets of system parameters, similar in concept to how Pluggable Authentication Modules (PAM) manage authentication stacks, but extended to broader system configurations. The name "pamundice" metaphorically suggests the ability to "undo" or "revert" a specific, potentially randomized or complex, system state ('diced'). It's intended to ensure system integrity and consistency across various deployment scenarios, enabling quick changes or restoration of configurations without manual intervention in disparate configuration files.


title: CAVEATS
content:
As a <b>fictional</b> command, its real-world implementation would require significant system integration. Hypothetically, <b>pamundice</b> operations are system-wide and require root privileges, as they modify critical system configurations. Improper use could lead to system instability, security vulnerabilities, or render the system unbootable. Always backup configurations before making significant changes.


title: PROFILE STRUCTURE
content:
System profiles for <b>pamundice</b> are hypothetically defined in declarative YAML or JSON files, specifying various system settings, service states, module configurations, and potentially even firewall rules. Each profile acts as a blueprint for a specific system state or security posture. These files are typically stored in a dedicated directory, e.g., <i>/etc/pamundice/profiles/</i>.


title: INTEGRATION WITH SYSTEM SERVICES
content:
Hypothetically, <b>pamundice</b> would integrate deeply with other system services like <i>systemd</i> for service management, <i>auditd</i> for security auditing, and potentially configuration management systems (e.g., Ansible, Puppet) for profile deployment. Activation of a profile would trigger a series of actions that update configuration files, restart services, and apply kernel parameters, ensuring the system conforms to the desired profile state.


title: HISTORY
content:
In this hypothetical scenario, <b>pamundice</b> was originally conceived as an internal tool within a large enterprise to manage consistent security baselines across a fleet of Linux servers. Its development was driven by the need for a unified interface to apply and revert complex configurations that involve multiple system services and modules. Over time, it evolved to support profile versioning and rollback capabilities, making it a crucial component for automated system deployment and disaster recovery in complex environments. Its design principles are inspired by the modularity of PAM and the declarative nature of modern configuration management tools.


title: PARAMETERS
content:
<b><b>-v</b>, <b>--verbose</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, providing more detailed information during the validation process, including warnings and successful checks.<br><br><b><b>-f</b> <i>configfile</i>, <b>--file</b> <i>configfile</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the path to a particular PAM configuration file to be validated. If this option is not provided, <b>pamvalidate</b> will default to checking <I>/etc/pam.conf</I> or all files within the <I>/etc/pam.d/</I> directory, depending on the system's PAM setup.<br><br>


title: DESCRIPTION
content:
The <b>pamvalidate</b> command is a utility for administrators to verify the integrity and syntax of <I>Pluggable Authentication Modules</I> (PAM) configuration files. <br><br>It examines specified configuration files (or the default system-wide PAM setup in <I>/etc/pam.conf</I> and <I>/etc/pam.d/</I> directory) for common errors such as incorrect syntax, missing or improperly configured modules, and invalid arguments.<br><br>By running <I>pamvalidate</I>, administrators can preemptively identify issues that could lead to authentication failures or security vulnerabilities, ensuring the system's authentication mechanisms function correctly and securely. It's an essential tool for debugging and maintaining PAM-related configurations.


title: CAVEATS
content:
While <b>pamvalidate</b> is excellent for syntax checking, it cannot detect logical errors in PAM configurations that might lead to unexpected authentication behavior (e.g., an incorrect order of modules that prevents a desired outcome). It also doesn't perform runtime checks; it's a static analysis tool. Always test PAM changes thoroughly in a controlled environment.


title: EXIT STATUS
content:
The <b>pamvalidate</b> command returns an exit status of <b>0</b> if the specified PAM configuration is valid and no errors are found. A non-zero exit status indicates that one or more problems or errors were detected in the configuration.


title: CONFIGURATION FILES
content:
PAM configuration is typically managed either through a single file, <I>/etc/pam.conf</I>, or more commonly on modern Linux distributions, through individual service-specific files located in the <I>/etc/pam.d/</I> directory. <br><br><b>pamvalidate</b> is designed to work with both setups, validating the collective configuration when no specific file is given.


title: HISTORY
content:
The <b>pamvalidate</b> utility is part of the broader <I>Pluggable Authentication Modules</I> (PAM) framework, which was developed in the mid-1990s to provide a flexible and modular approach to authentication services on Unix-like operating systems. <br><br>While PAM itself has a rich history across various Unix flavors, <b>pamvalidate</b> specifically emerged as a crucial debugging and maintenance tool within the Linux PAM (Linux-PAM) project. Its inclusion reflects the need for administrators to easily verify the integrity of potentially complex PAM configuration files, helping to prevent system access issues caused by misconfigurations.


title: SYNOPSIS
content:
pandoc [<i>OPTIONS</i>] [<i>INPUTFILE</i>...]<br><br>Reads from <i>INPUTFILE</i>(s) or standard input if no files are given, and writes to standard output or a specified output file.


title: PARAMETERS
content:
<b>-f FORMAT, --from=FORMAT</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the input format of the document.<br><br><b>-t FORMAT, --to=FORMAT</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the output format for conversion.<br><br><b>-o FILE, --output=FILE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Write the converted output to the specified file.<br><br><b>-s, --standalone</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Produce a complete, standalone document with appropriate headers.<br><br><b>--template=FILE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use a custom template file for output generation.<br><br><b>-V KEY[=VAL], --variable=KEY[=VAL]</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Set a template variable (KEY) to an optional value (VAL).<br><br><b>-C, --citeproc</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enable processing of citations and bibliographies.<br><br><b>--bibliography=FILE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use the specified file for bibliographic data.<br><br><b>--toc, --table-of-contents</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Include a table of contents in the output.<br><br><b>--lua-filter=FILE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Apply a Lua filter script to transform the document's AST.<br><br><b>--filter=PROGRAM</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Run an external program as a filter on the document's AST.<br><br><b>--css=FILE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Link to a CSS stylesheet file for HTML output.<br><br><b>--mathjax, --katex, --mathml</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Render mathematical equations using the chosen method.<br><br><b>-D FORMAT, --print-default-template=FORMAT</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Print the default template for a given output format.<br><br><b>--list-input-formats</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display a list of all supported input formats.<br><br><b>--list-output-formats</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display a list of all supported output formats.<br><br><b>--extract-media=DIR</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Extract embedded media files (images, videos) to a specified directory.<br><br><b>--read-raw-html, --write-raw-html</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Control how raw HTML blocks are handled during conversion.<br><br><b>--data-dir=DIR</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specify the user data directory for templates, filters, etc.<br><br><b>-v, --version</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Show program version number and exit.<br><br><b>-h, --help</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Display a help message and exit.<br><br>


title: DESCRIPTION
content:
Pandoc is a powerful command-line tool designed for universal document conversion. It acts as a <I>swiss army knife</I> for markup, allowing seamless transformation between a vast array of formats including Markdown, reStructuredText, HTML, LaTeX, DocBook, EPUB, ODT, and DOCX. This versatility makes it an indispensable asset for writers, academics, publishers, and developers managing diverse document workflows. Pandoc excels at preserving document structure, metadata, and complex elements like citations, footnotes, and mathematical equations during conversion. Developed in Haskell, it's widely adopted for creating static websites, generating presentations, converting e-books, and automating complex document processing tasks, providing robust and reliable conversions.


title: CAVEATS
content:
<b>External Dependencies:</b> Certain output formats like PDF require external tools (e.g., a LaTeX distribution for high-quality PDF rendering).<br><b>Conversion Fidelity:</b> While robust, converting between very disparate formats may lead to minor loss of specific styling or features not inherently supported by the target format.<br><b>Complexity for Advanced Use:</b> Achieving highly customized outputs often requires familiarity with Markdown syntax, templates, and filter scripting (Lua or external programs).


title: FILTERS
content:
Pandoc's most powerful extensibility feature. Users can write custom programs (in any language) or Lua scripts to transform the document's intermediate representation (Abstract Syntax Tree or AST) during conversion, allowing for highly complex and specific transformations.


title: TEMPLATES
content:
For standalone document formats (like HTML, LaTeX, EPUB), Pandoc uses templates to control the overall structure and appearance of the output. Users can customize these templates to achieve precise layout and styling, offering immense flexibility beyond basic format conversion.


title: PANDOC MARKDOWN
content:
While supporting many Markdown flavors, Pandoc has its own extended version, which includes features like definition lists, tables, footnotes, citations, and math, making it a rich and expressive format for writing academic and technical documents.


title: HISTORY
content:
Pandoc was created by <I>John MacFarlane</I>, with its initial public release in <I>2006</I>. Developed entirely in the functional programming language <I>Haskell</I>, it has significantly evolved over the years, adding support for a vast and ever-growing number of input and output formats. Its robustness, extensibility via filters and templates, and comprehensive format support have made it a widely adopted standard for document conversion in academic, publishing, and open-source communities. It continues to be actively maintained and developed.


title: SEE ALSO
content:
latex(1): Typesetting system often used by Pandoc for PDF generation., markdown(7): Refers to the Markdown format; Pandoc provides its primary implementation., odt2txt(1): Converts OpenDocument Text to plain text., html2text(1): Converts HTML to plain text.


title: PARAMETERS
content:
<b><B>--help</B>, <B>-h</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message with available command-line options and exits.<br><br><b><B>--version</B>, <B>-v</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs the program's version information and exits.<br><br><b><B>--display</B>=<I>DISPLAY</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the X display to connect to.<br><br><b><B>--debug</B></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose debugging output, useful for applet developers to troubleshoot issues.<br><br><b><B>--test-file</B>=<I>FILE</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Loads and tests the applet defined by the specified <I>FILE</I>. This is typically an applet's .desktop file or a specific test configuration.<br><br>


title: DESCRIPTION
content:
<I>panel-test-applets</I> is a specialized utility primarily used by developers and advanced users to test <I>GNOME Panel</I> and <I>MATE Panel</I> applets in an isolated environment. It creates a lightweight, dummy panel where applets can be loaded and interacted with, without requiring a full desktop session or affecting the user's primary panel configuration. This tool is invaluable for debugging, developing, and performing quality assurance on panel applets, as it allows for rapid iteration and testing of an applet's behavior, appearance, and resource usage. Developers can use options like <B>--test-file</B> to specify a particular applet to load. While its relevance has diminished in modern GNOME (which utilizes <I>GNOME Shell</I>), it remains a core component for development within desktop environments that maintain the classic panel architecture, such as MATE.


title: CAVEATS
content:
This command is primarily intended for <I>GNOME 2</I> and <I>MATE</I> desktop environments. It is not typically used by general end-users. <br>It may not be installed by default or even available in modern <I>GNOME Shell</I> installations, as <I>GNOME 3</I> and later versions utilize a different extension and applet model. <br>The dummy panel environment does not fully emulate all behaviors or integrations of a live desktop panel.


title: APPLET DEVELOPMENT WORKFLOW
content:
<I>panel-test-applets</I> is an indispensable tool in the development workflow for <I>GNOME Panel</I> and <I>MATE Panel</I> applets. Instead of repeatedly logging out and back in, or restarting the entire panel to test changes, developers can use this command to quickly load, unload, and debug their applet code. This significantly accelerates the development and debugging cycle, allowing for more efficient creation and refinement of panel functionalities.


title: HISTORY
content:
The <I>panel-test-applets</I> utility emerged as a crucial developer tool alongside the <I>GNOME 2</I> desktop environment, providing a dedicated sandbox for testing applets designed for its traditional panel. With the transition to <I>GNOME 3</I> and <I>GNOME Shell</I>, its direct relevance to mainstream GNOME development diminished. However, it continues to be actively used and maintained within desktop environments that fork or maintain the classic <I>GNOME 2</I> panel architecture, most notably the <I>MATE Desktop</I> environment.


title: PARAMETERS
content:
<b><b>-p</b>, <b>--paper</b>, <b>--papersize</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints only the name of the default paper size (e.g., "A4", "letter").<br><br><b><b>-W</b>, <b>--width</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints only the width of the default paper size in points.<br><br><b><b>-H</b>, <b>--height</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints only the height of the default paper size in points.<br><br><b><b>-s</b>, <b>--size</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prints the paper name, width, and height. This is often the default behavior if no specific output options are provided.<br><br><b><b>--no-pretty-print</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses the descriptive labels (e.g., "papername:", "width:") from the output, providing raw values suitable for scripting.<br><br><b><b>-h</b>, <b>--help</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message and exits.<br><br><b><b>-V</b>, <b>--version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Outputs version information and exits.<br><br>


title: DESCRIPTION
content:
<i>paperconf</i> is a utility designed to query and display the default paper size configured for the current system environment. It plays a crucial role for applications that need to adapt to locale-specific or administratively defined paper dimensions for printing or document layout.<br><br>The command prioritizes configuration sources in the following order: the <b>PAPERCONF</b> environment variable, followed by the <i>/etc/papersize</i> file. If neither of these specifies a paper size, <i>paperconf</i> intelligently determines the default by inspecting the system's locale settings (specifically <b>LC_ALL</b>, <b>LC_PAPER</b>, or <b>LANG</b>), usually defaulting to "letter" for US locales and "A4" for most other regions. Beyond just the paper name, it can also output the precise width and height of the paper in points, making it valuable for precise formatting tasks.


title: CAVEATS
content:
The accuracy of <i>paperconf</i>'s output heavily relies on correct system locale configuration or the presence of the <i>/etc/papersize</i> file. If these are misconfigured or absent, <i>paperconf</i> might default to a paper size that doesn't align with the user's actual locale or administrative settings. For instance, in some environments, it might default to <b>A4</b> even if <b>letter</b> is preferred, or vice-versa, if locale information is ambiguous or not properly set up. It's primarily a query tool; to change the system-wide paper size, <i>paperconfig</i> must be used.


title: ENVIRONMENT VARIABLES
content:
<i>paperconf</i> respects the <b>PAPERCONF</b> environment variable. If set, its value will be used as the paper size, overriding <i>/etc/papersize</i> and locale settings. Additionally, locale-related environment variables like <b>LC_ALL</b>, <b>LC_PAPER</b>, and <b>LANG</b> influence its fallback paper size determination.


title: CONFIGURATION FILE
content:
The <i>/etc/papersize</i> file is a crucial configuration source. It should contain a single line specifying the default paper size (e.g., "A4" or "letter"). This file is typically managed by the <i>paperconfig</i> command.


title: HISTORY
content:
<i>paperconf</i> is typically part of the <i>util-linux</i> or <i>cups-filters</i> package on many Linux distributions. Its history is tied to the evolution of printing systems and locale management in Unix-like environments. It was developed to provide a standardized way for applications, especially those involved in document formatting and printing, to retrieve the system's preferred paper dimensions, reducing hardcoded assumptions and improving internationalization. While not a standalone project with a distinct long history, its functionality has been essential for consistent paper size handling across various Linux desktop and server environments for many years.


title: PARAMETERS
content:
<b>-h, --help</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message and exits.<br><br><b>-V, --version</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Shows version information and exits.<br><br><b>-q, --quiet</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses output messages.<br><br><b>-s SIZE, --size=SIZE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the default paper size to SIZE (e.g., <i>a4</i>, <i>letter</i>). Requires root privileges for system-wide changes.<br><br><b>-p, --papernames</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Lists all available paper size names supported by the command.<br><br><b>-l, --list</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Lists all programs currently configured or recognized by <b>paperconfig</b>.<br><br><b>-f, --force</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces configuration for a program even if a default configuration is not found.<br><br><b>-c, --check</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Checks the current configuration of the paper size for all recognized programs.<br><br><b>--add PROGRAM</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adds a specific PROGRAM to the list of programs managed by <b>paperconfig</b>.<br><br><b>--remove PROGRAM</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Removes a specific PROGRAM from the list of programs managed by <b>paperconfig</b>.<br><br><b>--set PROGRAM SIZE</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the paper size for a specific PROGRAM to SIZE. This overrides the global default for that program.<br><br><b>--query PROGRAM</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Queries and displays the currently configured paper size for a specific PROGRAM.<br><br>


title: DESCRIPTION
content:
The <b>paperconfig</b> command is a utility designed to manage and set the default paper size for various TeX and TeX Live programs, such as <i>dvips</i>, <i>dvipdfm</i>, and <i>xdvi</i>. It provides a centralized way to ensure that documents generated or viewed by these applications use a consistent paper dimension (e.g., A4, Letter).<br><br>Instead of manually configuring each TeX-related tool, <b>paperconfig</b> allows administrators or users to set a system-wide or user-specific default paper size. This is particularly useful in environments where a specific paper standard is predominantly used, streamlining the printing and viewing workflow of TeX-generated documents.


title: CAVEATS
content:
<b>paperconfig</b> primarily affects programs within the TeX/LaTeX ecosystem. Changes made system-wide (without a user-specific configuration) often require root privileges. User-specific paper settings (e.g., via environment variables or personal configuration files) may override system defaults set by <b>paperconfig</b> for certain applications.


title: HISTORY
content:
Originating from the TeX Live distribution, <b>paperconfig</b> was developed to standardize and simplify paper size configuration across the diverse set of utilities used for processing TeX/LaTeX documents. Its introduction addressed the need for a consistent approach to managing output dimensions, reducing potential errors and inconsistencies when generating print-ready files or viewing documents on different systems. It's an integral part of the TeX infrastructure rather than a general-purpose Linux command.


title: SYNOPSIS
content:
<b>paperkey</b> [<i>options</i>] <<i>exported-private-key-file</i>><br><b>paperkey</b> --decode [<i>options</i>]<br><b>paperkey</b> --decode [<i>options</i>] --filename <<i>paperkey-output-file</i>>


title: PARAMETERS
content:
<b><b>--decode</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Reconstructs an OpenPGP secret key from previously generated paperkey output.<br><br><b><b>--output</b> <<i>filename</i>>, <b>-o</b> <<i>filename</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the file to which the generated paperkey output will be written. If omitted, output goes to standard output.<br><br><b><b>--filename</b> <<i>filename</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the input file to read from when using <b>--decode</b>. If omitted, <b>--decode</b> reads from standard input.<br><br><b><b>--comment</b> <<i>text</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Adds a custom comment string to the beginning of the generated paperkey output.<br><br><b><b>--qr</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Generates the paperkey output as a series of QR codes. This is the default output format.<br><br><b><b>--hex</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Generates the paperkey output as hexadecimal digits.<br><br><b><b>--base64</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Generates the paperkey output as Base64 encoded data.<br><br><b><b>--bits</b> <<i>N</i>></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the number of bits encoded per "character" in the output. Useful for tweaking density for hex output.<br><br><b><b>--no-meta</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Excludes metadata (like key ID and creation date) from the paperkey output.<br><br><b><b>--no-compress</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Prevents compression of the key material before encoding. This results in larger output.<br><br><b><b>--version</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays the <b>paperkey</b> version information.<br><br><b><b>--help</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a summary of command-line options.<br><br>


title: DESCRIPTION
content:
<b>paperkey</b> is a command-line utility designed to create a secure, printable backup of an OpenPGP secret key. It encodes the key material into a compact, human-readable (or machine-readable, like QR codes) format suitable for printing on paper. This provides an essential offline archival method, safeguarding sensitive cryptographic keys from digital threats like hacking or data corruption.<br><br>The tool supports various output formats, including QR codes for optical scanning, hexadecimal digits, and Base64 encoding. While not a direct key recovery tool, <b>paperkey</b> generates an intermediate representation that can be decoded back into a GnuPG-compatible secret key using the <b>paperkey --decode</b> option. It is particularly valuable for backing up master OpenPGP keys or revocation certificates, which are critical for long-term key management and disaster recovery. Storing a physical copy in a secure location offers a robust alternative to purely digital backups.


title: CAVEATS
content:
The security of a key backed up with <b>paperkey</b> depends entirely on the physical security of the printed copy. It is vulnerable to theft, damage (e.g., fire, water), or simple loss.<br><br>Using <b>paperkey</b> implies trust in the printer; ensure the printer does not retain a copy of the sensitive data in its memory.<br><br>This tool is generally suited for long-term archival of master OpenPGP keys or revocation certificates, not for keys in active, frequent use.<br><br>The output is an encoded blob, not a directly readable private key. Recovery requires the <b>paperkey</b> utility itself.


title: SECURITY CONSIDERATIONS
content:
The primary security concern with <b>paperkey</b> output is its physical storage. Store the printed key in a highly secure, fireproof, and waterproof location, preferably in multiple geographically separated locations. Always use a trusted printer that does not retain memory of print jobs. Consider performing a test recovery to ensure the process works before relying solely on the paper backup. The generated output is a compressed, encoded representation, not a human-readable private key, thus providing a layer of obscurity, but not encryption.


title: TYPICAL WORKFLOW
content:
1. <b>Export the private key</b>: First, export the secret key you wish to back up from GnuPG: <i>gpg --export-secret-keys <keyid> > mykey.gpg</i>.<br><br>2. <b>Generate paperkey output</b>: Convert the exported key to a printable format. For QR codes: <i>paperkey --qr mykey.gpg > mykey_paper.txt</i>. For hexadecimal: <i>paperkey --hex mykey.gpg > mykey_hex.txt</i>.<br><br>3. <b>Print the output</b>: Print <i>mykey_paper.txt</i> or <i>mykey_hex.txt</i> using a trusted printer.<br><br>4. <b>Verify recovery (recommended)</b>: To confirm the backup is valid, decode it back into a GnuPG key file: <i>paperkey --decode < mykey_paper.txt > recovered_mykey.gpg</i>. You can then attempt to import this recovered key into a <i>test</i> GnuPG keyring: <i>gpg --import recovered_mykey.gpg</i>.


title: HISTORY
content:
<b>paperkey</b> was originally developed by <i>David S. Miller</i> (davem@davemloft.net) and <i>Daniel J. Bernstein</i> (djb@cr.yp.net). Its creation addresses the need for a robust, offline backup mechanism for cryptographic keys, specifically OpenPGP secret keys, to complement digital security measures. It provides a means to protect keys against purely digital attacks or data loss scenarios, making it a critical component in comprehensive key management strategies since its inception.


title: PARAMETERS
content:
<b>-h, --help</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays a help message and exits.<br><br><b>--version</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Shows the program's version information and exits.<br><br><b>-v, --verbose</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output for debugging and detailed information.<br><br><b>-s <I>SERVER</I>, --server=<I>SERVER</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the PulseAudio server to connect to.<br><br><b>-d <I>DEVICE</I>, --device=<I>DEVICE</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Selects the audio output device (sink) for playback.<br><br><b>-n <I>NAME</I>, --client-name=<I>NAME</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Assigns a custom client name, visible in PulseAudio tools.<br><br><b>-ss <I>NAME</I>, --stream-name=<I>NAME</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Assigns a custom stream name for this playback session.<br><br><b>-p <I>PROPERTY</I>, --property=<I>PROPERTY</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets a specific PulseAudio property on the audio stream.<br><br><b>--volume=<I>VOLUME</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the playback volume (0-65536, where 65536 is 100%).<br><br><b>--rate=<I>RATE</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Overrides the sample rate of the audio stream.<br><br><b>--format=<I>FORMAT</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Forces a specific sample format (e.g., s16le, float32ne).<br><br><b>--channels=<I>CHANNELS</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the number of audio channels.<br><br><b>--raw</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Treats the input file as raw (headerless) audio data.<br><br><b>--loop</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Continuously loops the playback of the audio file(s).<br><br><b>--file-format=<I>FORMAT</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Overrides auto-detection of the input file format.<br><br><b>--latency=<I>LATENCY</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Requests a specific playback latency in milliseconds.<br><br><b>--process-id=<I>PID</I></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Associates the stream with a specific process ID.<br><br><b>--no-remix</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables channel remixing by the PulseAudio server.<br><br><b>--no-srb</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Disables server-side resampling and remixing.<br><br><b>--realtime</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Requests real-time scheduling for the playback thread.<br><br><b>--high-priority</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Requests high priority for the playback thread.<br><br>


title: DESCRIPTION
content:
<i>paplay</i> is a command-line utility for playing audio files through the PulseAudio sound server. It's designed to be simple and integrates seamlessly with the PulseAudio ecosystem, allowing users to play various audio formats. It can play local files and supports specifying the target server, output device, volume, and various audio stream properties like sample rate, format, and channels. It's often used for quick audio playback, scripting, or testing PulseAudio setups. Being a core component of PulseAudio, it benefits from the server's capabilities such as network audio, per-application volume control, and dynamic device switching. It supports common audio formats like WAV, FLAC, and Ogg Vorbis, relying on <i>libsndfile</i> for decoding, and offers options for raw audio playback and continuous looping.


title: CAVEATS
content:
<i>Requires a running PulseAudio sound server to function.</i><br><i>File format support is dependent on libsndfile and PulseAudio's build options; MP3 playback usually requires external plugins or transcoding.</i><br><i>Offers only a command-line interface; no graphical controls.</i><br><i>The --loop option repeats the entire list of files if multiple are provided.</i>


title: EXIT STATUS
content:
<i>paplay</i> typically exits with status 0 on successful playback. A non-zero exit status indicates an error, such as a file not found, an invalid argument, or an inability to connect to the PulseAudio server.


title: EXAMPLES
content:
To play a simple WAV file:<br><code>paplay audio.wav</code><br><br>To play an FLAC file on a specific output device with verbose output:<br><code>paplay -v --device=my_speakers song.flac</code><br><br>To continuously loop an Ogg Vorbis file:<br><code>paplay --loop jingle.ogg</code>


title: HISTORY
content:
<i>paplay</i> is a fundamental utility within the PulseAudio sound system, which was originally introduced as 'Polly' in 2004 and rebranded to PulseAudio in 2006. As a core component, <i>paplay</i> has been present since the early stages of PulseAudio's development, providing basic sound playback functionality. Its evolution has been closely tied to PulseAudio's goals of offering advanced audio features like network transparency, per-application volume control, and improved hardware abstraction.


title: PARAMETERS
content:
<b><code>--help</code></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Displays a help message and exits.</i><br><br><b><code>--version</code></b><br>&nbsp;&nbsp;&nbsp;&nbsp;<i>Shows version information and exits.</i><br><br>


title: DESCRIPTION
content:
<i><b>paprefs</b> is a graphical user interface (GUI) tool designed to manage various global settings for the PulseAudio sound server. It provides an intuitive way to configure network-related PulseAudio features, such as enabling network access to the local sound server, allowing other computers to discover and play sound through it, or enabling local sound output to be streamed to remote UPnP/DLNA renderers.<br><br>Users can toggle modules like <code>module-native-protocol-tcp</code> for network-wide audio streaming, and <code>module-upnp-discover</code> for UPnP/DLNA device discovery. <b>paprefs</b> simplifies tasks that would otherwise require manual editing of PulseAudio configuration files (e.g., <code>default.pa</code>) or complex command-line operations with <b>pactl</b>. It's particularly useful for setting up a centralized audio server or for streaming audio across a local network, offering a user-friendly alternative to command-line configuration.</i>


title: CAVEATS
content:
<i><br>Requires an active X server and a graphical environment to run.<br>Changes made in <b>paprefs</b> often modify system-wide PulseAudio configuration, which might require a PulseAudio restart or system reboot to take full effect.<br>Network features configured via <b>paprefs</b> can pose security risks if not properly secured on untrusted networks.<br>Its functionality might be limited or deprecated in favor of other tools or direct configuration file editing for advanced scenarios.</i>


title: <I>COMMON CONFIGURATION AREAS</I>
content:
<i>Inside the <b>paprefs</b> GUI, users typically interact with tabs such as:</i><br><i><b>"Network Access"</b>: To enable or disable network control over local sound devices.</i><br><i><b>"Network Servers"</b>: To allow other computers to discover and use local PulseAudio devices.</i><br><i><b>"Simultaneous Output"</b>: To configure concurrent playback to multiple sinks.</i><br><i><b>"UPnP/DLNA"</b>: To enable discovery of UPnP/DLNA renderers and stream local audio to them.</i>


title: HISTORY
content:
<i><b>paprefs</b> has been an integral part of the PulseAudio ecosystem, providing a user-friendly front-end for managing its extensive configuration options, especially those related to network audio. Its development is tied to the evolution of PulseAudio itself, aiming to simplify complex settings that otherwise require command-line expertise or manual file editing. It addresses the common need for network discovery and streaming capabilities without a deep dive into PulseAudio modules, making network audio setup more accessible for general users.</i>


title: SYNOPSIS
content:
<b>par2</b> [<i>options</i>] <b>create</b> [<i>options</i>] <i>base_filename</i> [<i>files...</i>]<br><b>par2</b> [<i>options</i>] <b>verify</b> [<i>options</i>] <i>base_filename</i> [<i>files...</i>]<br><b>par2</b> [<i>options</i>] <b>repair</b> [<i>options</i>] <i>base_filename</i> [<i>files...</i>]


title: PARAMETERS
content:
<b>--</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Separates command-line options from filenames, useful if filenames start with a hyphen.<br><br><b>-r<n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the desired level of redundancy as a percentage (e.g., -r10 for 10% recovery blocks).<br><br><b>-s<n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Sets the recovery block size in bytes. Larger blocks are faster but less granular.<br><br><b>-b<n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Specifies the exact number of recovery blocks to create (alternative to -r).<br><br><b>-c<n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Limits the number of recovery files created by <b>par2</b>.<br><br><b>-l</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Lists the contents of a <b>.par2</b> file (blocks, files covered).<br><br><b>-v</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Enables verbose output, showing more details about the process.<br><br><b>-q</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppresses most output, showing only critical errors or results.<br><br><b>-h</b><br>&nbsp;&nbsp;&nbsp;&nbsp;Displays help information and usage instructions.<br><br><b>-N<n></b><br>&nbsp;&nbsp;&nbsp;&nbsp;(<i>create mode</i>) Specifies the number of volumes to split the original files into.<br><br><b>-R</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(<i>repair mode</i>) Automatically renames repaired files (e.g., <i>filename.corrupt</i> to <i>filename</i>).<br><br><b>-a</b><br>&nbsp;&nbsp;&nbsp;&nbsp;(<i>verify/repair mode</i>) Automatically adds missing files from the current directory for consideration.<br><br>


title: DESCRIPTION
content:
<b>par2</b> is a command-line utility used to protect files from corruption. It works by creating "parity files" (with <i>.par2</i> extensions) which contain redundant information about the original data. If any of the original files become corrupted or are missing, these parity files can be used to recreate the lost data, provided enough parity data is available.<br><br>This is particularly useful for data transferred over unreliable networks (like Usenet binaries) or stored on potentially failing media. <b>par2</b> calculates checksums and redundant blocks, allowing it to detect and repair even single-bit errors or entirely missing files from a set. It's an improvement over its predecessor, PAR (PAR1), offering better efficiency and robustness, especially with large numbers of files or complex corruption scenarios. Users typically create parity files for important data, then later use them to verify integrity or repair damaged files.


title: CAVEATS
content:
<ul><li><b>Resource Intensive:</b> Creating parity files, especially for large datasets, can consume significant CPU and disk I/O resources and take a considerable amount of time.</li><li><b>Disk Space:</b> Parity files add to the total disk space required for your data. The amount depends on the redundancy level.</li><li><b>Original Files Needed:</b> <b>par2</b> can only repair files if the original (or parts of the original) data is still available, along with sufficient parity data. It cannot recreate data from scratch using only parity files without any original data.</li><li><b>Not for Security:</b> <b>par2</b> is designed for data integrity against accidental corruption or loss, not for protection against malicious tampering or encryption.</li></ul>


title: OPERATION MODES
content:
<b>par2</b> operates in three primary modes:<br><ul><li><i>create:</i> Generates <b>.par2</b> recovery files from a set of original files.</li><li><i>verify:</i> Checks the integrity of original files against existing <b>.par2</b> recovery files.</li><li><i>repair:</i> Uses <b>.par2</b> recovery files to rebuild or fix corrupted/missing original files.</li></ul>


title: FILE NAMING CONVENTION
content:
<b>par2</b> creates a base <b>.par2</b> file (e.g., <i>archive.par2</i>) and several <b>.volXXX+YY.par2</b> files (e.g., <i>archive.vol000+01.par2</i>), where <i>XXX</i> is the starting block and <i>YY</i> is the number of blocks in that volume. These volumes contain the actual recovery data.


title: HISTORY
content:
<b>par2</b> is the successor to the original PAR (Parity Archive Volume Set) format, often referred to as PAR1. PAR1, primarily developed by Tobias Richter, gained popularity for error correction of binary files distributed across Usenet newsgroups. However, PAR1 had limitations, particularly with large numbers of files, handling renamed files, and efficiency.<br><br><b>par2</b>, developed by Peter Brian (often attributed to his pseudonym Parchive), addressed these shortcomings by introducing more advanced Reed-Solomon error correction algorithms, better file management, and improved performance, making it the de-facto standard for Usenet binary error recovery and general data integrity protection.


title: SYNOPSIS
content:
<b>parallel</b> [<i>options</i>] [<i>command</i> [<i>arguments...</i>]] <b>:::</b> [<i>arguments...</i>]<br><b>parallel</b> [<i>options</i>] [<i>command</i> [<i>arguments...</i>]] <b>:::+</b> [<i>arguments...</i>]<br><b>parallel</b> [<i>options</i>] [<i>command</i> [<i>arguments...</i>]] <b>--</b> [<i>arguments...</i>]<br><b>parallel</b> [<i>options</i>] &lt; <i>input_file</i><br><i>some_command</i> | <b>parallel</b> [<i>options</i>] [<i>command</i> [<i>arguments...</i>]]


title: PARAMETERS
content:
<b><b>-j</b> <i>N</i>, <b>--jobs</b> <i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Run <i>N</i> jobs in parallel. 0 means as many as possible (one per CPU core).<br><br><b><b>-n</b> <i>N</i>, <b>--max-args</b> <i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use at most <i>N</i> arguments per command line. Similar to <i>xargs</i> -n.<br><br><b><b>--pipe</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Input is read from stdin and passed as a single argument per job, line by line.<br><br><b><b>--pipe-part</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Input is read from stdin and split into parts, each part becoming stdin for a job.<br><br><b><b>--rsh</b> <i>shell</i>, <b>--ssh</b> <i>shell</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Use <i>rsh</i> or <i>ssh</i> for remote execution on specified hosts.<br><br><b><b>--workdir</b> <i>dir</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Change to this directory on the remote or local host before executing the command.<br><br><b><b>--results</b> <i>dir</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Store output, stderr, and exit status of each job in files within the specified directory.<br><br><b><b>--colsep</b> <i>regexp</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Treat <i>regexp</i> as the argument separator in input lines. Default is whitespace.<br><br><b><b>--group</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Group the output of each command together, printing it only after the command finishes.<br><br><b><b>--keep-order</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Output results in the same order as the input arguments, possibly delaying output.<br><br><b><b>--dry-run</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Print the commands that would be executed without actually running them.<br><br><b><b>--delay</b> <i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Wait <i>N</i> seconds between starting new jobs. Useful for preventing resource exhaustion.<br><br><b><b>--eta</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Show estimated time of arrival for the entire job.<br><br><b><b>--no-notice</b></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Suppress the initial 'To cite GNU Parallel...' notice.<br><br><b><b>--timeout</b> <i>N</i></b><br>&nbsp;&nbsp;&nbsp;&nbsp;Terminate a job if it runs longer than <i>N</i> seconds.<br><br>


