man-page-pts-updates-20080605

[openafs.git] / doc / man-pages / pod8 / ptserver.pod

diff --git a/doc/man-pages/pod8/ptserver.pod b/doc/man-pages/pod8/ptserver.pod
index 228e58b..454ae92 100644 (file)
--- a/doc/man-pages/pod8/ptserver.pod
+++ b/doc/man-pages/pod8/ptserver.pod
@@ -7,9 +7,14 @@ ptserver - Initializes the Protection Server
 =for html
 <div class="synopsis">
 
-B<ptserver> S<<< [B<-database> <I<db path>>] >>> S<<< [B<-p> <I<number of threads>>] >>>
-    [B<-rebuildDB>] [B<-enable_peer_stats>] [B<-enable_process_stats>]
-    [B<-allow-dotted-principal>] [B<-rxbind>] [B<-help>]
+B<ptserver> S<<< [B<-database> | B<-db> <I<db path>>] >>> S<<< [B<-p> <I<number of threads>>] >>>
+    [B<-rebuildDB>] S<<< [B<-groupdepth> <I<# of nested groups>>] >>>
+    S<<< [B<-default_access> <I<user access mask>> <I<group access mask>>] >>>
+    [B<-restricted>] [B<-enable_peer_stats>]
+    [B<-enable_process_stats>] [B<-allow-dotted-principal>]
+    [B<-rxbind>] S<<< [B<-auditlog> <I<file path>>] >>>
+    S<<< [B<-syslog>[=<I<FACILITY>>]] >>> S<<< [B<-rxmaxmtu> <I<bytes>>] >>>
+    [B<-help>]
 
 =for html
 </div>
@@ -48,6 +53,14 @@ request. The CPS lists all groups to which a user or machine belongs.
 
 =back
 
+When using Kerberos 5, cross-realm authentication is possible. If the
+special pts group system:authuser@FOREIGN.REALM exists and its group quota
+is greater than zero, B<aklog> will automatically create an entry for the
+foreign user in the local PTS database and add the foreign user to the
+system:authuser@FOREIGN.REALM PTS group.  Each time a foreign user is
+created in the local PTS database, the group quota for the
+system:authuser@FOREIGN.REALM PTS group is decremented by one.
+
 This command does not use the syntax conventions of the AFS command
 suites. Provide the command name and all option names in full.
 
@@ -55,7 +68,7 @@ suites. Provide the command name and all option names in full.
 
 =over 4
 
-=item B<-database> <I<db path>>
+=item B<-database> <I<db path>>, B<-db> <I<db path>>
 
 Specifies the pathname of an alternate directory in which the Protection
 Database files reside. Provide the complete pathname, ending in the base
@@ -75,6 +88,24 @@ Rebuilds the Protection Database at the beginning of Protection Server
 initialization. Use this argument only in consultation with AFS
 Development or Product Support.
 
+=item B<-groupdepth> <I<# of nested groups>>, B<-depth> <I<# of nested groups>>
+
+Specifies the group depth for nested groups when B<ptserver> is compiled
+with the SUPERGROUPS option enabled.  The default depth for nested groups
+is 5.  This option may be shortened to B<-depth>.
+
+=item B<-default_access> <I<user access>> <I<group access>>
+
+Specifies the default user and group privacy flags to apply to each
+entry. Provide a string of five characters, one for each of the
+permissions. See L<pts_examine(1)> or L<pts_setfields(1)> for more
+information on the flags.
+
+=item B<-restricted>
+
+Run the PT Server in restricted mode. While in restricted mode, only
+members of the system:administrators PTS group may make any PTS changes.
+
 =item B<-enable_peer_stats>
 
 Activates the collection of Rx statistics and allocates memory for their
@@ -94,17 +125,32 @@ Monitoring API.
 =item B<-allow-dotted-principal>
 
 By default, the RXKAD security layer will disallow access by Kerberos
-principals with a dot in the first component of their name. This is to avoid
-the confusion where principals user/admin and user.admin are both mapped to the
-user.admin PTS entry. Sites whose Kerberos realms don't have these collisions 
-between principal names may disable this check by starting the server
-with this option.
+principals with a dot in the first component of their name. This is to
+avoid the confusion where principals user/admin and user.admin are both
+mapped to the user.admin PTS entry. Sites whose Kerberos realms don't have
+these collisions between principal names may disable this check by
+starting the server with this option.
 
 =item B<-rxbind>
 
 Bind the Rx socket to the primary interface only.  (If not specified, the
 Rx socket will listen on all interfaces.)
 
+=item B<-syslog>[=<I<syslog facility>>]
+
+Specifies that logging output should go to syslog instead of the normal
+log file.  B<-syslog>=I<FACILITY> can be used to specify to which facility
+the log message should be sent.  Logging message sent to syslog are tagged
+with the string "ptserver".
+
+=item B<-auditlog> <I<file path>>
+
+Specifies the full pathname for the B<AuditLog> file.
+
+=item B<-rxmaxmtu> <I<bytes>>
+
+Sets the maximum transmission unit for the RX protocol.
+
 =item B<-help>
 
 Prints the online help for this command. All other valid options are