PHPIndex

.. raw:: pdf

   PageBreak

tl-config
=========

Synopsis
--------

**tl-config** [*options*] <*parameter*>[**=**\ *value*] ...

Description
-----------

The :program:`tl-config` command is used to access configuration
parameters used by the ThinLinc system. It is also used to set
parameters from scripts, and can be used instead of an editor when some
parameter needs to be changed. :program:`tl-config` uses
:program:`hivetool`, part of the Hiveconf system. See :ref:`hiveconf`
for more information about Hiveconf.

Options
-------

.. option:: -a, --all-entries

   Print all parameters and folders in given folder.

.. option:: -i, --import=file

   Import all parameters in *file*.

.. option:: -p, --purge=file

   Remove parameters in *file* which exists elsewhere.

.. option:: -R, --recursive

   When using :option:`-a`, ascend folders recursively.

.. option:: -e, --eval=VAR=parameter

   Print parameter value in format suitable for assignment to shell
   variable via evaluation.

.. option:: -E folder

   As :option:`-e` but print all variables in specified folder.

.. option:: --version

   Prints the ThinLinc version and exits.

.. option:: -x, --export

   When using :option:`-e`, :option:`--eval`, or :option:`-E`, also export
   the variables.

.. option:: -h, --help

   Prints a short help text and exits.

Examples
--------

Print all values in root, recursively:

.. code:: console

   $ tl-config -Ra /

Set :servconf:`/vsmagent/agent_hostname` to ``agent.example.com``:

.. code:: console

   $ tl-config /vsmagent/agent_hostname=agent.example.com

Print value of :servconf:`/vsmagent/agent_hostname`:

.. code:: console

   $ tl-config /vsmagent/agent_hostname
   agent.example.com

Set environment variable :environ:`AGENTNAME` to value of
:servconf:`/vsmagent/agent_hostname`:

.. code:: console

   $ eval $(tl-config -e AGENTNAME=/vsmagent/agent_hostname)

Set all variables in :servconf:`/vsmagent/default_environment` as
environment variables:

.. code:: console

   $ eval $(tl-config -E /vsmagent/default_environment/)

.. raw:: pdf

   PageBreak

tl-desktop-restore
==================

Synopsis
--------

**tl-desktop-restore**

Description
-----------

When a user's Gnome or KDE desktop needs to be reset to default, the
command :program:`tl-desktop-restore` can be run. This will move the
settings directories for KDE and Gnome to a backup directory named
:file:`~/.old-thinlinc-desktop` in the user's home directory, which will
make both Gnome and KDE revert to the default settings.

.. raw:: pdf

   PageBreak

tl-disconnect
=============

Synopsis
--------

**tl-disconnect**

Description
-----------

:program:`tl-disconnect` allows a user to disconnect their ThinLinc
client from their ThinLinc session by running a console command. The
ThinLinc session will be kept on the server, waiting for the user to
reconnect. This command needs to be run from inside a ThinLinc session.

.. raw:: pdf

   PageBreak

tl-env
======

Synopsis
--------

**tl-env** [*options*] <*command*> [*args*]

Description
-----------

**tl-env** can be used to run a user provided command in a ThinLinc
session. This can even be done from outside the session itself. It does
so by temporarily restoring the session environment before executing the
command. It operates on the file :file:`xstartup.env` in the session
directory.

During restore, the option :option:`--skip-display` can be used to
exclude the :environ:`DISPLAY` environment variable.

By default, **tl-env** operates on the *last* session number for the
invoking user. An alternative session number can be specified with the
:option:`--session-number` option.

Options
-------

.. option:: -d, --skip-display

   Do not restore :environ:`DISPLAY`.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -n nr, --session-number=nr

   Use specified session number. The default is "last".

.. option:: --version

   Prints the ThinLinc version and exits.

.. raw:: pdf

   PageBreak

tl-gen-auth
===========

Synopsis
--------

**tl-gen-auth** [*password*]

Description
-----------

The :program:`tl-gen-auth` command can be used to generate a password
hash for ThinLinc Web Administration. The generated hash should be
stored in the setting :servconf:`/tlwebadm/password`.

:program:`tl-gen-auth` will prompt for a password if *password* is not
specified on the command line.

.. raw:: pdf

   PageBreak

tl-ldap-certalias
=================

Synopsis
--------

**tl-ldap-certalias** [*options*]

Description
-----------

The :program:`tl-ldap-certalias` command can automatically update the
local databases needed for smart card public key authentication,
provided the system uses the OpenSSH server (or any SSH server that uses
a compatible format and location for authorized public keys) and
standards compliant LDAP servers where users and certificates are
stored.

The :program:`tl-ldap-certalias` command can also perform validation of
certificates it finds in LDAP databases. Read more about this in
:ref:`certalias_validation`.

-  On invocation, a list of all users and matching certificates is
   gathered. How is determined by the |certificate_user_match|
   configuration variable. If |allow_invalid_certificates| is no, only
   matching valid certificates will be gathered.

   .. |certificate_user_match| replace::
      :servconf:`certificate_user_match
      </utils/tl-ldap-certalias/certificate_user_match>`
   .. |allow_invalid_certificates| replace::
      :servconf:`allow_invalid_certificates
      </utils/tl-ldap-certalias/allow_invalid_certificates>`

-  The user's home directory, as well as the :file:`~/.ssh` directory,
   are created if they are required and do not already exist.
   :program:`tl-ldap-certalias` reuses the
   :servconf:`/vsmagent/make_homedir_mode` configuration variable from
   vsmagent for determining the default permissions of newly created
   home directories.

-  Any old public keys added by :program:`tl-ldap-certalias` are removed
   from the :file:`~/.ssh/authorized_keys` file and the keys from the
   current set of certificates are added.

-  The file :file:`/etc/passwdaliases` is updated with a list of subject
   names and user id:s, to allow for login without usernames. See
   :ref:`smartcard_auto` for more information.

.. note::

   It should be noted that any custom entries in
   :file:`~/.ssh/authorized_keys` will be retained, but custom changes
   to :file:`/etc/passwdaliases` will be overwritten each time
   :program:`tl-ldap-certalias` is run.

After deployment, :program:`tl-ldap-certalias` is meant to be run from
cron at regular intervals, for example every 15 minutes. This makes sure
that the ThinLinc system automatically keeps all user certificates
updated. However, please note that if you're using certificate
validation, downloading and parsing certificate revocation lists may
take a long time (up to 5 minutes each). This is mitigated by caching
the data from the CRL:s, but the first run, and whenever the CRL needs
to be updated, may take a long time. Thus, if you have certificates from
a lot of different certificate authorities, don't run
:program:`tl-ldap-certalias` too often.

Since the default use of this tool is to be run from cron, the default
behaviour is to produces no output other than error messages. If you
want more output from :program:`tl-ldap-certalias`, see the options
section.

.. note::

   The root user must able to write to the users' home directories for
   :program:`tl-ldap-certalias` to be able to update the
   :file:`~/.ssh/authorized_keys` files.

.. _certalias_config:

Configuration
^^^^^^^^^^^^^

:program:`tl-ldap-certalias` uses the
:servconf:`/utils/tl-ldap-certalias` hiveconf folder for configuration
purposes. On a standard ThinLinc installation, it's located in
:file:`/opt/thinlinc/etc/conf.d/tl-ldap-certalias.hconf`. See
:ref:`configuration_tl_ldap_certalias` for details about the available
parameters.

.. _certalias_validation:

Certificate validation
^^^^^^^^^^^^^^^^^^^^^^

:program:`tl-ldap-certalias` can perform validation of certificates
found in LDAP databases by the following methods if
|allow_invalid_certificates| is set to ``no``:

Certificate validity and expiry dates
   :program:`tl-ldap-certalias` now checks the certificate validity and
   expiry dates and rejects certificates that are not valid yet or have
   expired.

Matching certificate to certificate issuers
   Place the CA certificates you wish to trust certificates from in
   :file:`/opt/thinlinc/etc/ca/`. The CA certificates must be in DER
   form. If :program:`tl-ldap-certalias` finds a certificate with an
   issuer that does not match any of the certificates in
   :file:`/opt/thinlinc/etc/ca/`, the certificate will be considered
   invalid and ignored.

Certificate revocation lists
   :program:`tl-ldap-certalias` searches the certificates it encounter
   for certificate revocation lists (CRL) to make sure that the
   certificate has not been revoked by its issuer. Once downloaded, the
   CRL will be cached until the time for the next scheduled update found
   in the CRL list has passed.

   .. note::

      :program:`tl-ldap-certalias` can only handle CRL lists distributed
      with HTTP.

Validation of certificate signatures.
   :program:`tl-ldap-certalias` can verify that the certificate
   signature is valid and thus assures that the certificate has not been
   tampered with.

Options
-------

.. option:: -d, --debug

   Turn on extra debugging output to standard output. This is off by
   default.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -s, --simulate

   Dry run mode. Specifying this option tells
   :program:`tl-ldap-certalias` to avoid writing any changes to disk.
   This is off by default.

.. option:: -v, --verbose

   Turn on program status output to standard output. This is off by
   default.

.. option:: --version

   Prints the ThinLinc version and exits.

.. raw:: pdf

   PageBreak

tl-memberof-group
=================

Synopsis
--------

**tl-memberof-group** <*groupname*> [*groupname*...]

Description
-----------

:program:`tl-memberof-group` can be used to determine if the current
user is a member of the specified groups.

Exit status
-----------

0
   The executing user is a member of any of the given groups.
1
   The executing user is not a member of any of the groups.
2
   One or more of the specified groups cannot be found.

Examples
--------

Is user a member of the root group?

.. code:: console

   $ tl-memberof-group root

Is the user member of the sysadmin or techsupport groups?

.. code:: console

   $ tl-memberof-group sysadmin techsupport

.. raw:: pdf

   PageBreak

tl-mount-localdrives
====================

Synopsis
--------

**tl-mount-localdrives** [*options*]

Description
-----------

The :program:`tl-mount-localdrives` command is used to mount the
exported local drives from the ThinLinc client in the current session.
The drives will be mounted below :file:`$TLSESSIONDATA/drives`. A
symbolic link called :file:`thindrives` will be created in the user’s
home directory, pointing to this directory.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -v, --verbose

   Print more details about what actions are taken.

.. option:: --version

   Prints the ThinLinc version and exits.

Notes
-----

When using multiple sessions per user, the :file:`~/thindrives` link
will point to the newest session that executed
:program:`tl-mount-localdrives`.

See also
--------

:program:`tl-umount-localdrives`\ (1)

.. raw:: pdf

   PageBreak

tl-notify
=========

Synopsis
--------

**tl-notify** [*options*] <*message*>

Description
-----------

This command sends a user-visible message to ThinLinc sessions on the
server. The default is to send the message to all sessions, but the
:option:`-u` option can be used to send the message to a single
recipient instead.

To send messages to all users in a ThinLinc cluster, you can use this
command in combination with the :program:`tl-ssh-all`\ (8) command.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -u, --user=USER

   User to send message to. The default is "all".

.. option:: --version

   Prints the ThinLinc version and exits.

.. raw:: pdf

   PageBreak

tl-rsync-all
============

Synopsis
--------

**tl-rsync-all** [*options*] <*source*> [*source*]...

Description
-----------

The :program:`tl-rsync-all` command is used to synchronize files and
directories in a ThinLinc cluster. It runs the :command:`rsync`\ (1)
command over SSH against all agent servers in the cluster.

*options* can be any :command:`rsync`\ (1) option.

All specified sources will be converted to absolute paths.

Examples
--------

Synchronize directory tree:

.. code:: console

   $ tl-rsync-all -a --delete /some/tree

See also
--------

:command:`rsync`\ (1), :program:`tl-ssh-all`\ (8)

.. raw:: pdf

   PageBreak

tl-session-param
================

Synopsis
--------

**tl-session-param** [*options*] <*parameter*>

Description
-----------

The :program:`tl-session-param` command is used to access the session
information managed by the master. This includes information sent by the
client, such as if the client has exported any local drives, or what
language is set on the client side.

Options
-------

.. option:: -a, --all-entries=FOLDER

   Print all parameters and values in a folder.

.. option:: -e, --eval=VAR=parameter

   Print parameter value in a format suitable for assignment to a shell
   variable, via evaluation.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: --version

   Prints the ThinLinc version and exits.

Examples
--------

Print all the top level session information:

.. code:: console

   $ tl-session-param -a /

Set :environ:`LANG` to the client's language:

.. code:: console

   $ tl-session-param -e LANG=/client_params/capabilities/client_lang

Print the client's IP address:

.. code:: console

   $ tl-session-param /client_ip

.. raw:: pdf

   PageBreak

tl-setup
========

Synopsis
--------

**tl-setup** [*options*]

Description
-----------

ThinLinc Setup is used to configure the ThinLinc server for the local
system, and to modify the local system as is required for the ThinLinc
server to function correctly.

ThinLinc Setup can be run graphically, in text mode, or in a fully
automated mode.

Options
-------

.. option:: -a, --answers-from=FILE

   Run tl-setup in non-interactive mode and read the answers from
   *FILE*.

.. option:: -g, --generate-answers=FILE

   Generate an answer file template and store it in *FILE*.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: --version

   Prints the ThinLinc version and exits.

.. raw:: pdf

   PageBreak

tl-show-licenses
================

Synopsis
--------

**tl-show-licenses**

Description
-----------

The :program:`tl-show-licenses` command can be used to show the total
number of ThinLinc user licenses currently found on disk.

.. raw:: pdf

   PageBreak

tl-single-app
=============

Synopsis
--------

**tl-single-app** <*command*> [*args*]

Description
-----------

The :program:`tl-single-app` command can be used to execute a single
application in a ThinLinc session. A window manager with a suitable
configuration is automatically started. All top level windows are
automatically maximized. Window titles are displayed in the title bar of
the ThinLinc Client, not in the ThinLinc session. The client close
button will disconnect the session as usual. Inner close buttons
closes application windows. The :program:`tl-single-app` command can be
specified as a client supplied start program (see
:ref:`configuration_start_program`), or used with the ThinLinc profile
selector (see :ref:`configuration_config-profiles`).

.. tip::

   If the application opens multiple top level windows, you can switch
   between them by clicking on the application icon in the top left
   corner.

Examples
--------

Start Firefox via tl-single-app:

.. code:: console

   $ tl-single-app firefox

.. raw:: pdf

   PageBreak

tl-ssh-all
==========

Synopsis
--------

**tl-ssh-all** [*options*] [*command*]

Description
-----------

The :program:`tl-ssh-all` command is used to perform shell commands on
all agents in a ThinLinc cluster. It works by running the
:command:`ssh`\ (1) command against all agent servers in the cluster.

*options* can be any :command:`ssh`\ (1) option.

See also
--------

:command:`ssh`\ (1), :program:`tl-rsync-all`\ (8)

.. raw:: pdf

   PageBreak

tl-sso-password
===============

Synopsis
--------

**tl-sso-password** [*options*]

Description
-----------

The :program:`tl-sso-password` command can be used to hook up the single
sign-on mechanism of ThinLinc with new applications. It can be used to
test for the presence of a valid password and to feed that password out
on standard output to another application.

To check for the existance of a valid password, invoke the command as
:option:`tl-sso-password --check`. A return code of zero indicates a
valid password.

If the :option:`--remove` option is specified, the password will be
removed, after the retrieval or check.

There are two basic models to connect :program:`tl-sso-password` to an
application. The first is to use shell pipes:

.. code:: console

   $ tl-sso-password | /usr/bin/application --read-password-on-stdin

The second is to have the application invoke :program:`tl-sso-password`
as needed:

.. code:: console

   $ /usr/bin/application --password-prog tl-sso-password

Options
-------

.. option:: -c, --check

   Returns 0 if password is available, instead of fetch.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -r, --remove

   Removes the password after fetch or check.

.. option:: --version

   Prints the ThinLinc version and exits.

See also
--------

:program:`tl-sso-token-passphrase`\ (1)

.. raw:: pdf

   PageBreak

tl-sso-token-passphrase
=======================

Synopsis
--------

**tl-sso-token-passphrase** [*options*]

Description
-----------

This command is identical to :program:`tl-sso-password`\ (1), except
that it uses the smart card token passphrase (PIN) instead of the user's
password. For usage, see the :program:`tl-sso-password`\ (1) page.

Options
-------

.. option:: -c, --check

   Returns 0 if token passphrase is available, instead of fetch.

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -r, --remove

   Removes the token passphrase after fetch or check.

.. option:: --version

   Prints the ThinLinc version and exits.

See also
--------

:program:`tl-sso-password`\ (1)

.. raw:: pdf

   PageBreak

tl-sso-update-password
======================

Synopsis
--------

**tl-sso-update-password**

Description
-----------

This command requests a password from the user, to be used with the
single sign-on mechanism of ThinLinc. It is useful when the password is
not already available, for example, when using one time passwords. See
:ref:`authentication_securid` for more information.

.. raw:: pdf

   PageBreak

tl-support
==========

Synopsis
--------

**tl-support** [**-p** <*listen-port*>] [**-u** <*user*>] [*host*\ [**:**\ *port*]]

Description
-----------

The :program:`tl-support` command can be used to enable a support
technician to login to your ThinLinc server, even though the server is
behind a firewall that doesn't allow connections to the ssh port. This
is accomplished by opening a ssh connection from the server to an
external server on the internet, at the same time setting up a tunnel
from the remote host to the local host's ssh port. The default server to
connect to is "support.thinlinc.com" with the default username
"support". This command should only be used after contacting your
ThinLinc support technician.

If *host* is not specified, "support.thinlinc.com" is assumed.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -p listen-port, --port=listen-port

   The remote port to listen on. If not specified, a random port will be
   used.

.. option:: -u user, --user=user

   Username to connect as. The default is "support".

.. option:: --version

   Prints the ThinLinc version and exits.

.. raw:: pdf

   PageBreak

tl-umount-localdrives
=====================

Synopsis
--------

**tl-umount-localdrives** [*options*]

Description
-----------

The :program:`tl-umount-localdrives` command is used to unmount local
drives previously set up by :program:`tl-mount-localdrives`\ (1). By
default it only unmounts the local drives for the current session, but
it can also unmount the local drives for all of the user's sessions by
specifying :option:`-s`, or all local drives for all users on the
current agent by specifying :option:`-a`.

Options
-------

.. option:: -a, --all-users

   Unmount all shared local drives for all users on this server (root
   required).

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: -l, --no-adjust-symlink

   Do not update the :file:`~/thindrives` link when unmounting
   filesystems.

.. option:: -s, --all-sessions

   Unmount all shared local drives for the current user on this server.

.. option:: -v, --verbose

   Print more details about what actions are taken.

.. option:: --version

   Prints the ThinLinc version and exits.

Notes
-----

When using multiple sessions per user, the :file:`~/thindrives` link
will point to the newest session that executed
:program:`tl-mount-localdrives`\ (1). :program:`tl-umount-localdrives`
will restore the link to the newest session which is not newer than the
current session and which has mounted local drives.

See also
--------

:program:`tl-mount-localdrives`\ (1)

.. raw:: pdf

   PageBreak

tl-while-x11
============

Synopsis
--------

**tl-while-x11** <*command*> [*args*]

Description
-----------

The program :program:`tl-while-x11` runs the command specified by
*command* and terminates it when the X11 server exits. The arguments
specified by *args* become the arguments to *command*.

.. raw:: pdf

   PageBreak

tlctl load
==========

Synopsis
--------

**tlctl load** [*options*] <*command*> [*args*]

Description
-----------

:program:`tlctl load` displays the current load status of the ThinLinc
cluster, as currently measured by ThinLinc. It can be used to get a
quick overview of the health of the system, or to help debug unexpected
load balancing decisions.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

Commands
--------

**list** [*options*]
   List the basic load numbers for all agents in the cluster, with subcluster
   association displayed if multiple subclusters exist.

   .. option:: --sort=HEADER

      Sort the list of agents specified by *HEADER*. The default is "AGENT".
      Available headers are found in the list below.

   Definition of command output:

   AGENT
       Agent names.
   USERS
       Total numbers of users, accounting for system and ThinLinc users.
   MEM
       Aggregated RAM and Swap used memory.
   CPU
       Aggregated CPU used over all available CPUs.
   RATING
       Quantification of agent capacity for additional sessions, where for instance
       10.0 rating corresponds to approximately 10 additional sessions.

**show** <*AGENT*>
   Show all load information for the agent specified by *AGENT*.

   Definition of command output:

   Subclusters
       All the subclusters the agent is associated with. This line is printed if
       there exists multiple subclusters, regardless if the agent in question is
       associated with one or more subclusters.
   Number of users
       Total numbers of users, accounting for system and ThinLinc users.
   Memory (used RAM\+Swap)
       Aggregated RAM and Swap used memory.
   RAM (used/total)
       Used RAM memory / total RAM memory.
   Swap (used/total)
       Used Swap memory / total Swap memory.
   Load (1 min)
       CPU load 1 minute average.
   Number of CPUs
       Number of available CPUs.
   CPU
       Aggregated CPU used over all available CPUs.
   Bogomips
       Computational capacity.
   Rating
       Quantification of agent capacity for additional sessions, where for
       instance 10.0 rating corresponds to approximately 10 additional
       sessions.
   Penalty points
       Received e.g. when the agent is slow to respond or when additional users
       connect, which directly affects the rating of the agent.
   Last updated
       Timestamp of content update.

.. raw:: pdf

   PageBreak

tlctl session
=============

Synopsis
--------

**tlctl session** [*options*] <*command*> [*args*]

Description
-----------

:program:`tlctl session` can be used to inspect and control sessions in
the ThinLinc cluster.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

Commands
--------

**list** [*options*]
   List the currently running sessions in the ThinLinc cluster. If no
   options are specified then all sessions will be listed. Multiple
   options can be combined to further restrict which sessions will be
   listed.

   Note that the listed information only is updated periodically, and
   hence it is possible for e.g. the session's status to be slightly
   outdated at times.

   .. option:: --agent=AGENT

      Only show the sessions running on *AGENT*.

   .. option:: --display=DISPLAY

      Only show the sessions with display id *DISPLAY*.

   .. option:: --subcluster=SUBCLUSTER

      Only show the sessions running in *SUBCLUSTER*.

   .. option:: --user=USERNAME

      Only show the sessions belonging to *USERNAME*.

**terminate** [*options*]
   Terminate one or more sessions in the ThinLinc cluster. At least one
   option must be given specifying with sessions to terminate. Multiple
   options can be combined to further restrict which sessions will be
   terminated.

   If the :option:`--allow-abandon` option is specified, in addition to
   terminating reachable sessions, unreachable sessions will be
   abandoned. When a session is abandoned, the master will stop tracking
   it which may leave stray processes on the associated agent machine.

   .. option:: --agent=AGENT

      Terminate all sessions running on *AGENT*.

   .. option:: --all

      Terminate all sessions in the ThinLinc cluster.

   .. option:: --allow-abandon

      Also abandon sessions that are unrechable and thus cannot be
      terminated.

   .. option:: --display=DISPLAY

      Terminate all sessions with display id *DISPLAY*.

   .. option:: --subcluster=SUBCLUSTER

      Terminate all sessions running in *SUBCLUSTER*.

   .. option:: --user=USERNAME

      Terminate all sessions belonging to *USERNAME*.

   .. option:: -y, --assume-yes

      Automatically answer yes for all questions.

.. raw:: pdf

   PageBreak

tlctl
=====

Synopsis
--------

**tlctl** [*options*] <*command*> [*args*]

Description
-----------

:program:`tlctl` can be used to inspect and control the state of a
ThinLinc cluster. Note that this command only works when executed on a
master machine in the ThinLinc cluster.

Options
-------

.. option:: -h, --help

   Prints a short help text and exits.

.. option:: --version

   Prints the ThinLinc version and exits.

Commands
--------

:program:`tlctl-load`\ (8)
   Show cluster load information.

:program:`tlctl-session`\ (8)
   Manage sessions.