Supports the following operations:

1. directory add

   This operation creates a child pointer in the parent directory. The argument is a list of names of parent directories to have child pointers added to them. The value of the required -member option is a list of names of child pointers to be added to each of the directories listed in the argument. Each child pointer name entered should only contain the last RDN of the name. The child object must exist or the command will return an error. The full name of a clearinghouse that holds a replica of the child directory is given as the value to the required -clearinghouse option. This option may only have one value and is used for each of the values of the -member option. Returns an empty string on success. If a child pointer of the same name already exists an error is returned.

   This command is only needed to recreate a child pointer that was accidently deleted, i.e., in a troubleshooting situation. Normally child pointers are created internally by CDS when creating directories with the directory create command.

2. directory create

   Creates a new directory of the specified name. The argument is a list of names of directories to be created. Takes an optional -attribute option to specify a list of attributes to be included in each created directory. Added attributes are multi-valued unless a -single option is specified, in which case all attributes are single-valued. The -single option is only valid if the -attribute option is specified. Takes an optional -clearinghouse option to specify a clearinghouse to create all the directories in. The value of this option is not a list, it is only one clearinghouse name to create all the directories named in the argument in. If this option is not specified, the new directories are created in the same clearinghouse as the parent directory. Also takes a -replica option which indicates that a directory replica is created; when this option is used, the -clearinghouse option is required. Returns an empty string on success.

3. directory delete

   Used to delete a directory. When called without the -tree option, the directory must be empty or an error is generated. The argument is a list of names of directories to be deleted. There is a -replica and a -clearinghouse option which must be used together to delete a replica instead of a directory. The clearinghouse the replica is in is specified as the value of the -clearinghouse option; only one value can be specified, not a list.

   An optional -tree option (takes no value) is supported to remove the named directory and everything (all directories, objects, links, and clearinghouses) beneath it. If the -tree option used, the -replica and -clearinghouse options are illegal. It is recommended that a directory synchronize (a.k.a. skulk) command be performed immediately before this operation is executed. Errors cause the operation to terminate immediately.

   Returns an empty string on success. If a specified directory does not exist, an error is generated.

4. directory help

   Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

5. directory list

   Returns a list of the names of all the descendants of a directory. The argument is a list of names of directories to be operated on. Descendants includes all directories, objects, links, and clearinghouses of the directory. Since only the names are returned there is no way to tell the class of each name unless by convention (e.g., most clearinghouses end with _ch). The following options can be used to specify the types of descendents to return: -directories, -objects, -links. They take no values and can be used in combination. By default fullnames are returned, the -simplename option can be used to return merely the last RDN of the name.

6. directory merge

   This operation copies the contents of one directory into another. The argument is the name of the source directory. This command takes a required -into option to specify the destination directory which must exist. For example, if /.:/a has two child objects /.:/a/b and /.:/a/c, then a directory merge /.:/a -into /.:/x would result (assuming no errors) in the following objects: /.:/x/b and /.:/x/c.\*(f!

   Note that these are not: /.:/x/a/b and /.:/x/a/c. This type of operation can be performed by first creating the target directory and then merging to that object. In this case:

   
   .ft 5
   
   
    
   dcecp> directory create /.:/x/a
    
   dcecp> directory merge /.:/a -into /.:/x/a
   
   .ft 1
   
   
   

   Normally only the immediate contents of the directory are merged. This means all objects, links, and directories, but not the contents of child directories. To merge these as well, use the -tree option.

   By default, the new objects are placed in the destination directory's clearinghouse, and all children (no matter how many level down) are placed in the same clearinghouse. To place any newly created descendent directories in another clearinghouse, use the -clearinghouse option with a value.\*(f! There

   Any existing directories will continue to reside in the clearinghouse they were in.

   can only be one clearinghouse specified for all directories involved in the merge operation. To specify more than one, either change this after the merge has happened, or use separate commands.

   This command first checks for any collisions or ACL problems before beginning to merge any objects. If there are any problems encounted, an error is generated (not immediately, all objects are checked) and the names of all problem objects, links or directories are returned in a list. The administrator should then address these problems and rerun the merge command. If the -nocheck option is specified the check is not performed. This way time can be saved when trying a known non-problematic merge. This is not an atomic operation and other changes to the involved objects can cause problems. This command should be issued when others are not modifying the involved directories. Changing ACL's can be done to ensure this. If an error does occur during the actual merging process, it is generated and the operation aborts immediately.

   The merge command actually re-creates the objects with the same writable attributes of the source objecs. This means that some read-only attributes will change between the source and destination. For example, the creation timestamp attribute (i.e., CDS_CTS) will change. Also, the ACL's of the destination objects will probably be different from the source objects. The ACL's on the destination objects are just those that are inherited from the containers initial container or initial object ACL's.\*(f!

   This was a topic of debate. Other models considered were as follows. Copy the source ACL to the destination object, but this requires that the user performing the operation have sufficient rights to create each object in the tree. A merge of the ACL's could be performed so that the inherited ACL is merged with the source ACL. This avoids the create rights problem, but the ACL on the destination objects are not obvious. The merge discussed usually involves converting user ACL entries to foreign_user ACL entries if the default cell of the two ACL's differ.

7. directory modify

   Used to add, remove or change attributes and their values in a directory. The argument is a list of names of directories to be operated on. Attribute options are not supported; use one or more of -add, -remove or -change which each take an attribute list as an argument. All modifications are made to each directory listed in the argument. An error in any one causes the command to immediately abort and generate an error. The modifications are made (non-atomically) in the order specified on the command line. Returns an empty string on success.

   Since attributes in CDS can be multi-valued, some ambiguity can result in the syntax of some commands. To resolve this ambiguity, this command takes two additional options that describe the values to the -add and -remove options. Multi-valued attributes are considered to be the default case, when dealing with single-valued attributes the following options should be used:

   1. -single

      If this option is present then the attributes specified in the -add option are to be single-valued. Normally all user defined attributes are defined to be multi-valued, even if only one value is specifed. This option is not legal without the -add option.

   2. -types

      If this option is present then the value of the -remove option is a list of attribute types, indicating that the entire attribute should be removed, not just a value. This option is not legal without the -remove option.

8. directory operations

   Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

9. directory remove

   This operation deletes a child pointer from the directories specified. The argument is a list of names of directories to be operated on. The value of the required -member option is a list of child pointers (specified as only one RDN each) to be removed from each directory in the argument. Returns an empty string on success.

   This command is only needed to delete a child pointer that accidently remains after the child directory is deleted. Normally child pointers are removed internally by CDS when deleting directories with the directory delete command.

10. directory show

    Returns a list of attributes in the directories specified. The argument is a list of names of directories to be operated on. If more than one directory is specified then all the arguments are grouped together in one list. The order of the returned arguments is the lexical order of the OID's of each attribute for each directory. For example:

    dcecp> directory show /.:/hosts
    {RPC_ClassVersion 0200}
    {CDS_CTS 1994-06-18-20:16:52.888-05:00I0.000/\e
    00-00-c0-f7-de-56}
    {CDS_UTS 1994-07-01-10:29:59.265-05:00I0.000/\e
    00-00-c0-f7-de-56}
    {CDS_ObjectUUID 003d4d8e-d997-1db3-8259-0000c0f7de56}
    {CDS_Replicas
     {{CH_UUID 0066ccea-d978-1db3-8259-0000c0f7de56}
      {CH_Name /.../terrapin/drkstr_ch}
      {Replica_Type Master}
      {Tower ncacn_ip_tcp 130.105.5.16}
      {Tower ncadg_ip_udp 130.105.5.16}}}
    {CDS_AllUpTo 1994-07-01-20:30:18.316-05:00I0.000/\e
    00-00-c0-f7-de-56}
    {CDS_Convergence medium}
    {CDS_ParentPointer
     {{Parent_UUID 00146037-d97b-1db3-8259-0000c0f7de56}
      {Timeout
       {expiration 1994-05-02-23:29:13.749}
       {extension +1-00:00:00.000I0.000}}
      {myname /.../terrapin/hosts}}}
    {CDS_DirectoryVersion 3.0}
    {CDS_LinkTimeout
     {expiration 1996-04-20-20:00:00.000}
     {extension +0-00:00:10.000I-----}}
    {CDS_ReplicaState on}
    {CDS_ReplicaType Master}
    {CDS_LastSkulk 1994-07-01-20:30:18.316-05:00I0.000/\e
    00-00-c0-f7-de-56}
    {CDS_LastUpdate 1994-07-01-10:29:59.265-05:00I0.000/\e
    00-00-c0-f7-de-56}
    {CDS_RingPointer 0066ccea-d978-1db3-8259-0000c0f7de56}
    {CDS_Epoch 008fb182-d997-1db3-8259-0000c0f7de56}
    {CDS_ReplicaVersion 3.0}
    dcecp>
    

    Takes a -replica and a -clearinghouse option to specify that the contents of a replica are to be returned. This will return the directory specific and replica specific attributes for the replica. The -replica option takes no value. The value of the -clearinghouse option is the name of one clearinghouse (not a list of names) to be used for all replicas. If one of the directories mentioned in the argument list is not in the specified clearinghouse then an error is returned.

    Also takes an optional -member option with one required value which is the last RDN of child pointer in this directory. In this case the returned list describes the child pointer information for the specified member stored in the specified directories. This option may not be combined with the -replica or -clearinghouse option.

    A -schema option can be used to return whether an attribute is single or multi-valued. This is specific to a directory, i.e., the same attribute can be single-valued on one directory and multi-valued on another directory. This option may not be used with other options. For example:

    dcecp> directory show /.:/hosts -schema
    {RPC_ClassVersion multi}
    {CDS_CTS single}
    {CDS_UTS single}
    {CDS_ObjectUUID single}
    {CDS_Replicas multi}
    {CDS_AllUpTo single}
    {CDS_Convergence single}
    {CDS_ParentPointer multi}
    {CDS_DirectoryVersion single}
    {CDS_LinkTimeout single}
    {CDS_ReplicaState single}
    {CDS_ReplicaType single}
    {CDS_LastSkulk single}
    {CDS_LastUpdate single}
    {CDS_RingPointer single}
    {CDS_Epoch single}
    {CDS_ReplicaVersion single}
    dcecp>
    

11. directory synchronize

    Initiates a directory skulk of the directories specified. The argument is a list of names of directories to be operated on. Skulks are performed serially and begun immediately and the command does not return until all are finished. Returns an empty string on success.

link

The link object represents CDS softlinks. A softlink in the CDS directory service contains an attribute that has a name which is the name that the softlink points to. The softlink contains several built-in attributes, but users are not free to add their own. Softlinks can point to objects, directories, and other softlinks.

If the _s(cds) convenience variable is set, it is treated as the name of a clearinghouse to contact for this operation. This is the only clearinghouse that will be contacted in an attempt to complete the operation. These commands do not set the value of this variable after completion.

The following are the CDS defined attributes that may be present in a CDS softlink entry.

1. CDS_CTS

   Specifies the creation timestamp (CTS) of this softlink. The value of this attributes is DTS style timestamp. This attribute is written by the system and is read-only to users.

2. CDS_LinkTarget

   Specifies the full name of the directory, object entry, or other softlink to which the softlink points.

3. CDS_LinkTimeout

   Specifies a timeout value after which the softlink is either renewed or deleted. Its value is a list of two elements:

   1. The expiration-time. A date and time after which CDS checks for the existence of the softlink's target and either extends or deletes the soft link. The value is specified as yyyy-mm-dd-hh:mm:ss, and portions of it can be defaulted.
   2. The extension-time. A period of time by which to extend the softlink's expiration time (if the server has validated that the target still exists). The value is specified as ddd-hh:mm:ss, and portions of it can be defaulted.
4. CDS_UTS

   Specifies the timestamp of the most recent update to an attribute of the softlink. The value of this attributes is DTS style timestamp. This attribute is written by the system and is read-only to users.

Supports the following operations:

1. link create

   Creates a new softlink. The argument is a list of names of softlinks to be created. The CDS_LinkTarget attribute must be specified, either with the -linkto option, or with the -attribute option. The value is a single name that these new links point to. Addditionally the CDS_LinkTimeout attribute may be specified either with the -attribute option or with the -timeout option. The format for the value of these two options is slightly different. The following two commands do the same thing:

   dcecp> link create /.:/foo -linkto /.:/bar -timeout {
   > 1994-12-12-11:10:30.000 10-10:10:10}
   dcecp> link create /.:/foo -attribute {
   > {CDS_LinkTarget /.:/bar}
   > {CDS_LinkTimeout
   >   {expiration 1994-12-12-11:10:30.000}
   >   {extension 10-10:10:10}}
   > }
   dcecp>
   

   If the CDS_LinkTimout attribute is not included in the command line then the new softlinks are permanent and must be explicitly deleted. Returns an empty string on success.

2. link delete

   Deletes a softlink. The argument is a list of names of softlinks to be deleted. Returns an empty string on success. An error is returned if any of the objects do not exist.

3. link help

   Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

4. link modify

   The modify operation can be used to change two attributes of a softlink: CDS_LinkTarget and CDS_LinkTimeout. The argument is a list of names of softlinks to be operated on. Takes the -add, -remove, and -change options to specify an attribute list to describe the changes. All the changes are performed on each softlink named in the argument. Returns an empty string on success.

5. link operations

   Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

6. link show

   Returns an attribute list of the attributes in the specified softlinks. The argument is a list of names of softlinks to be operated on. If more than one softlink is to be shown, the attributes of all the softlinks are concatenated into one list with a blank line between softlinks. The order of the returned attributes is the lexical order of the OID's of each attribute for each softlink. For example:

   dcecp> link show /.:/link
   {CDS_CTS 1994-07-01-22:11:52.519-05:00I0.000/00-00-c0-f7-de-56}
   {CDS_UTS 1994-07-01-22:11:53.069-05:00I0.000/00-00-c0-f7-de-56}
   {CDS_LinkTarget /.../terrapin/hosts}
   {CDS_LinkTimeout
    {expiration 1996-05-01-20:00:00.000}
    {extension +0-10:10:10.000I-----}}
   

clearinghouse

The clearinghouse object represents CDS clearinghouses. Clearinghouses are databases located on CDS server machines that store the data in the CDS directory service. On the server machines are files that contain the actual clearinghouse data. Clearinghouses are also represented in the CDS namespace by an entry that contains information about the clearinghouse.

If the _s(cds) convenience variable is set, it is treated as the name of a clearinghouse to contact for this operation. This is the only clearinghouse that will be contacted in an attempt to complete the operation. These commands do not set the value of this variable after completion.

The following are the CDS defined attributes that may be present in a clearinghouse:

1. CDS_AllUpTo

   Indicates the date and time the clearinghouse object has been updated to reflect the CDS_CHDirectories attribute.

2. CDS_CHDirectories

   Specifies the full name and unique identifier (UUID) of every directory that has a replica in this clearinghouse.

3. CDS_CHLastAddress

   Specifies the current reported network address of the clearinghouse.

4. CDS_CHName

   Specifies the full name of the clearinghouse.

5. CDS_CHState

   Specifies the state of the clearinghouse. The state on indicates the clearinghouse is running and available.

6. CDS_CTS

   Specifies the creation timestamp (CTS) of the clearinghouse.

7. CDS_DirectoryVersion

   Specifies the current version of the directory in the clearinghouse in which the directory was created.

8. CDS_NSCellname

   Specifies the name of the cell in which the clearinghouse resides.

9. CDS_ObjectUUID

   Specifies the UUID of the clearinghouse, it is set by the system at clearinghouse creation time and, thereafter it is read-only, it may not be set by the user.

10. CDS_ReplicaVersion

    Specifies the current version of the replica in which the directory was created.

11. CDS_UpgradeTo

    A single-valued attribute used to control the upgrading of a directory from one version of CDS to another. By modifying this attribute, the process of upgrading a directory to a newer version of CDS may be initiated.

12. CDS_UTS

    Specifies the timestamp of the most recent update to an attribute of the clearinghouse.

The counters are:

1. badchs

   Specifies the number of times the clearinghouse entry missing event was generated.

2. baddata

   Specifies the number of times that the data corruption event was generated.

3. badskulks

   Specifies the number of times that a skulk of a directory, initiated from this clearinghouse, failed to complete\(em usually because one of the replicas in the replica set was unreachable.

4. badupgrades

   Specifies the number of times that upgrades failed.

5. disables

   Specifies the number of times that the clearinghouse was disabled since it was last started.

6. enables

   Specifies the number of times that the clearinghouse was enabled since it was last started.

7. partials

   Specifies the number of requests directed to this clearinghouse that resulted in the return of a partial answer instead of satisfying the client's request.

8. reads

   Specifies the number of read operations directed to this clearinghouse.

9. rootlosts

   Specifies the number of times the root lost event was generated.

10. writes

    Specifies the number of write operations directed to this clearinghouse.

Supports the following operations:

1. clearinghouse catalog

   Returns a list of the names of all clearinghouses in the specified cell. The optional argument specifies the cell and defaults to /.:.

2. clearinghouse create

   Creates a new clearinghouse on the local machine. Takes one argument which is the name of a new clearinghouse (it is not a list). Clearinghouses should only be named in the root directory (i.e., /.:). When this operation is invoked, a read-only replica of the root directory is stored in the new clearinghouse. Because the process that creates the new clearinghouse initiates a skulk of the root directory, all replicas of the root should be reachable when you enter the command. To ensure this, perform an immediate skulk of /.: prior to invoking this command, using the directory synchronize /.: command. Returns an empty string on success.

3. clearinghouse delete

   This operation deletes the clearinghouse given as an argument from the local machine. The argument is a list of names of clearinghouses to be deleted. Clearinghouses that contain master replicas of directories may not be deleted. This command also automatically deletes all read-only replicas from the clearinghouse, however it is recommended that all read-only replicas be deleted by hand before invoking this command since invoking many skulks will cause the command to execute slower. Returns an empty string on success.

4. clearinghouse disable

   This operation removes knowledge of the specified clearinghouse from the server running on the local machine. The argument is a list of names of clearinghouses to be operated on. It is useful when relocating a clearinghouse. Specifically the name of the prefix of the clearinghouse files is removed from the /opt/dcelocal/var/directory/cds/cds_files file and the local server is contacted and notified that the clearinghouse is disabled. The clearinghouse entry is not removed from the namespace, nor are the datafiles associated with the clearinghouse removed. Returns an empty string on success.

5. clearinghouse help

   Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

6. clearinghouse initiate

   Triggers an immediate checkpoint on the specified clearinghouse. The argument is a list of names of clearinghouses. There is a required -checkpoint option. Requires write permission to the CDS server. Returns an empty string on success.

7. clearinghouse operations

   Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

8. clearinghouse repair

   This command will repair a clearinghouse in a broken state. In DCE 1.1 it can only repair bad timestamps, one where the CDS_UTC value is in the future. Requires the -timestamps option. This command will disable the clearinghouse, scan for bad timestamps and correct them, checkpoint and re-enable the clearinghouse. The argument is a list of names of clearinghouses. Requires write permission to the CDS server. Returns an empty string on success.

9. clearinghouse show

   Returns an attribute list showing the attributes of the clearinghouse named as the argument. The argument is a list of names of clearinghouses to be operated on. If more than one clearinghouse is given as an argument, all the attributes from each are concatenated together into one list with a blank line between clearinghouses. The order of the returned attributes is the lexical order of the OID's of each attribute for each clearinghouse. For example:

   dcecp> clearinghouse show /.:/drkstr_ch
   {CDS_CTS 1994-06-18-20:16:22.150-05:00I0.000/00-00-c0-f7-de-56}
   {CDS_UTS 1994-06-19-17:17:43.911-05:00I0.000/00-00-c0-f7-de-56}
   {CDS_ObjectUUID 0066ccea-d978-1db3-8259-0000c0f7de56}
   {CDS_AllUpTo 1994-07-01-21:30:18.948-05:00I0.000/\e
   00-00-c0-f7-de-56}
   {CDS_DirectoryVersion 3.0}
   {CDS_CHName /.../terrapin/drkstr_ch}
   {CDS_CHLastAddress
    {Tower ncacn_ip_tcp 130.105.5.16}
    {Tower ncadg_ip_udp 130.105.5.16}}
   {CDS_CHState on}
   {CDS_CHDirectories
    {{Dir_UUID 00146037-d97b-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin}}
    {{Dir_UUID 0043797a-d991-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys}}
    {{Dir_UUID 004faa42-d992-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys/HP}}
    {{Dir_UUID 004fa65a-d993-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys/HP/sample-apps}}
    {{Dir_UUID 004b1130-d994-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys/dce}}
    {{Dir_UUID 00498a0e-d995-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys/dce/sec}}
    {{Dir_UUID 003ed80c-d996-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/subsys/dce/dfs}}
    {{Dir_UUID 003d4d8e-d997-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/hosts}}
    {{Dir_UUID 003bc522-d998-1db3-8259-0000c0f7de56}
     {Dir_Name /.../terrapin/hosts/drkstr}}
    {{Dir_UUID 0089ee8c-44e0-1dbe-929b-0000c0f7de56}
     {Dir_Name /.../terrapin/help}}
    {{Dir_UUID 001c6cea-00fb-1dc5-929b-0000c0f7de56}
     {Dir_Name /.../terrapin/test_1}}
    {{Dir_UUID 00440fe8-02a1-1dc5-929b-0000c0f7de56}
     {Dir_Name /.../terrapin/dirmod}}}
   {CDS_ReplicaVersion 3.0}
   {CDS_NSCellname /.../terrapin}
   dcecp>
   

   If given a -counters option returns an attribute list of the counters in the clearinghouse. The -all option can be used to return both attribute and counter information. The order is the attributes first then the counters as if the two commands were done one after the other. Counters are displayed in the order returned by the server, for example:

   dcecp> clearinghouse show /.:/foo_ch -counters
   {corruptions 0}
   {disables 0}
   {enables 1}
   {failedupgrades 0}
   {missingentries 0}
   {reads 2336}
   {returnedrefs 2}
   {rootunreachables 0}
   {skulkfailures 0}
   {writes 68}
   

10. clearinghouse verify

    Insures that a clearinghouse is in a correct state by performing the following checks. Requires write permission to the CDS server. Returns an empty string on success.

    1. Skulks directories if it is time to do so based on the value of the CDS_Convergence attribute.
    2. Upgrades directory replicas if a CDS_UpgradeTo attribute indicates to do so.
    3. Ensures that child and parent pointer information is correct. This involves ensuring that the set of replicas stored in the child pointer matches the set of replicas stored in the actual directory.
    4. Performs any need IP address changes in directories.
    5. Checks for primary cellname changes in the clearinghouse.
    6. Removes all old data (replicas and attributes) based on the value of the CDS_AllUpTo attribute.

    cdscache

    The cdscache object represents the cds cache on the local node. The CDS cache contains information about servers and clearinghouses known to the local machine, and also contains user data about CDS entries that have been read. The create and delete operations only apply to the server information. The show and dump commands can display other information. Supports the following operations:

    1. cdscache create

       This operation adds information about a CDS server to the local CDS cache. The argument is a list of names of servers to be added to the cache. These are the simple names of the machine, not the name of entry in the DCE namespace for the server (e.g. absolut not /.:/hosts/absolut/self). There is also one required option, -binding. This is the binding information for the server to be added to the CDS cache. The value must be a single partial string binding, not a list. Returns an empty string on success.

    2. cdscache delete

       This operation is used to remove information about a CDS server from the local CDS cache. The argument is a list of names of servers to be deleted from the cache. It can only be used to remove information added with the cdscache create command. Returns an empty string on success.

    3. cdscache dump

       Returns all information stored in the local CDS cache. It takes no argument. Returns an empty string on success. This command is meant to be used when debugging CDS problems. As such the output is not in a form easily parsed by Tcl. The user must have root privileges to run this command. This command may be removed from a production environment.

    4. cdscache help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. cdscache operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    6. cdscache show

       Returns information stored in the CDS cache. The argument is a list of names of either clearinghouses or (simple names of) servers about whose information from the cache is returned. Must be invoked with only one of the following options:-server or -clearinghouse to identify the type of the argument.

       dcecp> cdscache show /.:/drkstr_ch -clearinghouse
       {CH_Name /.../terrapin_cell.osf.org/drkstr_ch}
       {Created 1994-07-19-15:56:54.997}
       {Others 1512}
       {Reads 3467}
       {Tower {ncacn_ip_tcp 130.105.5.16}}
       {Tower {ncadg_ip_udp 130.105.5.16}}
       {Writes 249}
       dcecp> cdscache show drkstr -server
       {CH_Name /.../terrapin_cell.osf.org/drkstr_ch}
       {Tower {ncacn_ip_tcp 130.105.5.16}}
       {Tower {ncadg_ip_udp 130.105.5.16}}
       

    principal

    The principal object represents Registry principals. Unless otherwise noted, all of the operations of this object take one argument which is a list of names of principals to act on. They must be principal names (i.e., names relevant to the principal domain of the form /.../cellname/princname or princname to default the cellname.), not the names of the database objects that contains registry information about principals (i.e., they should not contain the string /sec/principal/). The names may be fully qualified or not, but if any are not fully qualified, then none may be.\*(f! Non-fully

    This limitation is to prevent possible ambiguity in the following case. Assume /.: refers to cell /.../foo.

    dcecp> set _s(sec) /.../bar
    dcecp> princ create {/.../zot/tom dick harry}
    

    What cell did the user intend to place dick and harry in?

    qualified names refer to a principal in the cell described in _s(sec) or in the cell of the local host if _s(sec) is not set.

    After this command executes, the _b(sec) convenience variable is set to the name of the server that was bound to for the command. The value of the variable _s(sec) before the command is treated as a hint, i.e., the server specified will be contacted if it can service the request. A case where it can't service the request is if a read-only registry was bound to, and the next command is a create command. In this case, the master registry will be bound to automatically and the _b(sec) variable updated appropriately. The value of the variable is the name of registry bound to in one of the formats specified as valid for the argument to the registry object.

    In the registry, each principal has a primary name, a value for each of the following attributes, and possibly some extended registry attributes:

    1. alias

       The value of this attribute is either yes or no. Each principal can have only one name, but may have one or more alias names. All these names refer to the same principal, and therefore the same UUID and uid. While aliases refer to the same principal they are separate entries in the registry database. Therefore the instance name given to a principal command can refer to either the primary name or an alias name of a principal. The value of this attribute determines this.

    2. fullname

       The full name of the principal, it is for information purposes only. It typically describes or expands a primary name to allow easy recognition by users. For example, a principal could have a primary name of jsbach and a fullname of Johann S. Bach. The value is a string, if it contains spaces, it is displayed in quotes, and on entry must be in quotes or braces (as per Tcl quoting rules). If not entered, the fullname defaults to the null string (that is, blank).

    3. quota

       Specifies the principal's object creation quota, the total number of registry objects that can be created by the principal. It is either a non-negative number or the string unlimited. A value of 0 prohibits the principal from creating any registry objects. Each time a principal creates a registry object, this value is decremented for that principal.

    4. uid

       The User Identifier for the principal. No two principals can have the same uid. However, aliases can share one uid. It is often called the Unix ID and is an integer.

    5. uuid

       An internal identifier for a principal. No two principals can have the same UUID.

    Supports the following operations:

    1. principal catalog

       Returns a list of the names of all principals in the registry. It takes no arguments. By default, fully qualified names are returned in the form cellname/principalname. If the -simplename option is given, then the cellname is not prepended to the front of the principal names. Names are returned in lexical order.

    2. principal create

       Creates a new principal. The argument is a list of names of principals to be created. Returns an empty string on success. Options are used to specify the attributes of the newly created principal. All options are applied to all principals in the argument.\*(f!

       Therefore do not use the -uid option when creating two principals with the same command, the second will fail since the uid is already in use after the first is created. However, the -alias and -uid options can be used to create several aliases to an existing principal with one command.

       Accepts a -attribute option to specify the attributes as an attribute list. The attribute options are:

       1. -alias

          Takes a value of either yes or no to specify if the newly created principal is an alias or not. The value of this attribute defaults to no.\*(f! When

          So specifying -alias no is never required.

          creating an alias, the -uid option is required to specify the uid of the primary principal to alias. For example, the following command creates an alias called postmaster for the principal with uid 1234:

          principal create postmaster -uid 1234 -alias yes
          

       2. -fullname

          The full name of the principal to be added to the registry. The value is a string. If it contains spaces, it must be in quotes or braces. If not entered, the fullname defaults to the null string (that is, blank).

       3. -quota

          Specifies the principal's object creation quota, the total number of registry objects that can be created by the principal. It is either a non-negative number or the string unlimited. If you do not specify this option the object creation quota defaults to unlimited.

       4. -uid

          The User Identifier for the principal. No two principals can have the same uid, however, aliases can share one uid with a principal. If this option is not present, then a uid will be assigned to the principal automatically. The value of this option is an integer.

       5. -uuid

          This option is only used to adopt an orphaned UUID. The value of this option is a UUID. Normally the UUID for a new principal is generated by the registry. In cases where data exists tagged with a UUID of a principal that has been deleted from the registry, this option can be used on the create command to specify the old UUID for a new principal. The UUID specified must be an orphan, i.e., a UUID for which no name exists in the registry. An error occurs if you specify a name (or uid, see below) that is already defined in the registry.

          The -alias option may not be used with this option. Both the -fullname and -quota options may be.

          If the principal is a cell principal, the -uid option can be used to specify the UNIX number to be associated with the principal. (If you do not enter this option for a cell principal, the next sequential UNIX number is supplied as a default by the registry.) For all principals other than cell principals, the uid is extracted from information embedded in the principal's UUID and cannot be specified here.

    3. principal delete

       This operation deletes principals from the registry. When a principal is deleted, the principal's account is deleted as well. The argument is a list of names of principals to be deleted. Note that these names can be either a primary or alias names. In either case, an account associated with that name is deleted. If a named principal does not exist an error is generated. Returns an empty string on success.

    4. principal help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. principal modify

       This operation is used to change attributes of principals. The argument is a list of names of principals to be operated on. All modifications are applied to all principals named in the argument. Principals are modified in the order they are listed and all modifications to an individual principal are atomic. Modifications to multiple principals are not atomic. A failure for any one principal in a list causes an error to be generated and the rest of the operation to be aborted. Returns an empty string on success.

       The -change option can be used to modify the value of any one of the above listed attributes (excep uid and uuid) or any ERA. The value of the -change option is an attribute list describing the new values for the specified attributes. Also supports the following attribute options: -alias, -quota, and -fullname. The -add and -remove options can be used to specify any ERA's, but not the above listed attributes, as each of them must always have a value.

    6. principal operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. principal rename

       This operation changes the name of a specified principal. The argument is a single name of a principal to be renamed. Takes a required -to option with a value of the new name. The value may not be a list. Returns an empty string on success.

    8. principal show

       This operation returns an attribute list describing the specified principals. The argument is a list of names of principals to be operated on. If more than one principal is given, then the attributes are concatenated together with a blank line between principals. There is one attribute in addition to the attributes described above. It is called groups and its value is a list of group names that the principal is a member of. Attributes are returned in the following order: fullname, uid, uuid, alias and quota followed by groups. If called with the -xattrs option then Extended Registry Attributes are returned instead of the above attributes. If called with -all then both are returned.

    group

    The group object represents Registry groups. Groups are collections of principal names. Unless otherwise noted, all of the operations of this object take one argument which is the name of the group to act on. It must be a group name, not the name of the database object that contains the registry information about the group (i.e., it should not begin with /.:/sec/group/). The names may be fully qualified or not, but if any are not fully qualified, then none may be. None fully qualified names refer to a group in the cell described in _s(sec) or in the cell of the local host if _s(sec) is not set. See the principal section for a description of how the _s(sec) and _b(sec) variables are handled by this command.

    In the registry, each group has a primary name, a value for each of the following attributes, and possibly some extended registry attributes:

    1. alias

       The value of this attribute is either yes or no. Each group can have only one name, but may have one or more alias names. All these names refer to the same group, and therefore the same UUID and gid. While aliases refer to the same group they are separate entries in the registry database. Therefore the instance name given to a group command can refer to either the primary name or an alias name of a group. The value of this attribute determines this.

    2. fullname

       The full name of the group, it is for information purposes only. It typically describes or expands a primary name to allow easy recognition by users. For example, a group could have a primary name of dce and a fullname of DCE Development. The value is a string, if it contains spaces, it is displayed in quotes, and on entry must be in quotes or braces (as per Tcl quoting rules). If not entered, the fullname defaults to the null string (that is, blank).

    3. gid

       The User Identifier for the group. No two groups can have the same gid, however, aliases can share one gid. It is often called the Unix ID and is an integer.

    4. inprojlist

       The value of this attribute is either yes or no. If it is no then members of this group will not accrue the access rights of this group.

    5. uuid

       An internal identifier for a group. No two groups can have the same UUID.

    Supports the following operations:

    1. group add

       This command is used to add a members to a group. The argument is a list of names of groups to be have members added to. The value of the required -member option is a list of names of principals to be added to each group in the argument. The principals must exist or the command will return an error. Returns an empty string on success.

    2. group catalog

       Returns a list of the names of all groups in the registry. It takes no arguments. By default, fully qualified names are returned in the form cellname/groupname. If the -simplename option is given then the cellname is not prepended to the front of the group names. The groups are returned in lexical order.

    3. group create

       Creates a new group. The argument is a list of names of groups to be created. Returns an empty string on success. Options are used to specify the attributes of the newly created group. All options are applied to all groups in the argument.\*(f!

       Therefore do not use the -gid option when creating two groups with the same command, the second will fail since the gid is already in use after the first is created. However, the -alias and -gid options can be used to create several aliases to an existing group with one command.

       Accepts a -attribute option to specify the attributes as an attribute list. The attribute options are:

       1. -alias

          Takes a value of either yes or no to specify if the newly created group is an alias or not. The value of this attribute defaults to no.\*(f! When

          So specifying -alias no is never required.

          creating an alias, the -gid option is required to specify the gid of the primary group to alias.
       2. -fullname

          The full name of the group to be added to the registry. The value is a string. If it contains spaces, it must be in quotes or braces. If not entered, the fullname defaults to the null string (that is, blank).

       3. -gid

          The Group Identifier for the group. If this option is not present, then a gid will be assigned to the group automatically.

       4. -inprojlist

          Specifies if the group is to be included in the principal's project list. The value of this field is either yes or no. If this option is not included in the command, then the yes value is used as a default.

       5. -uuid

          This option is only used to adopt an orphaned UUID. Normally the UUID for a new group is generated by the registry. In cases where data exists tagged with a UUID of a group that has been deleted from the registry, this option can be used on the create command to specify the old UUID for a new group. The UUID specified must be an orphan, i.e., a UUID for which no name exists in the registry. An error occurs if you specify a name that is already defined in the registry.

          Neither the -alias or -gid options may be used with this option. Both the -fullname and -inprojlist options may be.

    4. group delete

       This operation deletes a group from the registry. When a group is deleted, any accounts associated with that group are deleted as well. The argument is a list of names of groups to be deleted. If the groups do not exist an error is generated. Returns an empty string on success.

    5. group help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    6. group list

       Returns a list of the names of all members of a group. The argument is a list of names of groups to be operated on. If more than one group is listed, the names are concatenated together with a blank line between groups. By default, fully qualified names are returned in the form cellname/name. If the -simplename option is given then the cellname is not prepended to the front of the member names. The members of each group are listed in lexical order. Returns an empty string on success.

    7. group modify

       This operation is used to change attributes of groups. The argument is a list of names of groups to be operated on. All modifications are applied to all groups named in the argument. Groups are modified in the order they are listed and all modifications to an individual group are atomic. Modifications to multiple groups are not atomic. A failure for any one group in a list causes an error to be generated and the rest of the operation to be aborted. Returns an empty string on success.

       The -change option can be used to modify the value of any one of the above listed attributes (excep gid and uuid) or any ERA. The value of the -change option is an attribute list describing the new values for the specified attributes. Also supports the following attribute options: -alias, -inprojlist, and -fullname. The -add and -remove options can be used to specify any ERA's, but not the above listed attributes, as each of them must always have a value.

    8. group operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    9. group remove

       This command is used to remove a member from a group. The argument is a list of names of groups to have members removed from. The value of the required -member option is a list of names of principals which will be removed from the groups listed in the argument. When a member is removed from a group, any accounts associated with that principal and group are deleted.\*(f! Returns

       Remember that accounts are associated with a principal, a group, and an organization; so the statement means that any accounts where both the principal name and group name match those given to this command are removed, but accounts where only one matches are untouched.

       an empty string on success.
    10. group rename

        This operation changes the name of a specified group. The argument is a single name of a principal to be renamed. Takes a required -to option with a value of the new name. The value may not be a list. Returns an empty string on success.

    11. group show

        This operation returns an attribute list describing the specified groups. The argument is a list of names of groups to be operated on. If more than one group is given, then the attributes are concatenated together with a blank line between groups. Attributes are returned in the following order: fullname, gid, uuid, alias and inprojlist. If called with the -xattrs option then Extended Registry Attributes are returned instead of the above attributes. If called with -all then both are returned.

    organization

    The organization object represents Registry organizations. Organizations are collections of principal names. Unless otherwise noted, all of the operations of this object take one argument which is the name of the organization to act on. It must be an organization name, not the name of the database object that contains the registry information about the organization (i.e., it should not begin with /.:/sec/org/). The names may be fully qualified or not, but if any are not fully qualified, then none may be. None fully qualified names refer to a organization in the cell described in _s(sec) or in the cell of the local host if _s(sec) is not set. See the principal section for a description of how the _s(sec) and _b(sec) variables are handled by this command.

    Each organization has both attributes and policies associated with them. Policies regulate such things as account and password lifetimes for all accounts associated with a particular organization. In fact, these policies are the main feature that organizations provide. There are two types of policies referred to here, those associated with a particular organization, and those that are registry wide. Please note that there are other policies that are associated with accounts (and they also can be registry-wide).

    In the registry, each organization has a primary name, a value for each of the following attributes, and possibly some extended registry attributes:

    1. fullname

       The full name of the organization, it is for information purposes only. It typically describes or expands a primary name to allow easy recognition by users. For example, an organization could have a primary name of osf and a fullname of Open Software Foundation. The value is a string, if it contains spaces, it is displayed in quotes, and on entry must be in quotes or braces (as per Tcl quoting rules). If not entered, the fullname defaults to the null string (that is, blank).

    2. orgid

       The User Identifier for the organization. No two organizations can have the same orgid. However, aliases can share one orgid. It is often called the Unix ID and is an integer.

    3. uuid

       An internal identifier for a organization. No two organizations can have the same UUID. In normal use, this attribute will be set by the system and will be displayed for administrators, in some unusual cases an admin might want to set this value explicitly.

    The policies are:

    1. acctlife

       This policy defines the lifespan of accounts. It is specified as either an integer (for which the units are days) or the string unlimited.

    2. pwdalpha

       This policy defines whether or not passwords can consist entirely of alphanumeric characters. Its value is either yes or no.

    3. pwdexpdate

       This policy defines a date on which a password will expire. The date is entered as an internationalized date string or the string none in which case, there is no expiration date for the password.

    4. pwdlife

       This policy defines the lifespan of passwords. It is specified as either an integer number of days or the string unlimited. The tag days can follow the integer on output and is ignored on input, for example:

       {pwdlife 22 days}
       

    5. pwdminlen

       This policy defines the minimum number of characters in a password. Its value is a positive integer or the integer 0 which means there is no minimum length.

    6. pwdspaces

       This policy defines whether or not passwords can consist entirely of spaces. Its value is either yes or no.

    Supports the following operations:

    1. organization add

       This command is used to add a members to an organization. The argument is a list of names of organizations to be have members added to. The value of the required -member option is a list of names of principals to be added to each organization in the argument. The principals must exist or the command will return an error. Returns an empty string on success.

    2. organization catalog

       Returns a list of the names of all organizations in the registry. It takes no arguments. By default, fully qualified names are returned in the form cellname/name. If the -simplename option is given then the cellname is not prepended to the front of the organization names. The organizations are returned in lexical order.

    3. organization create

       Creates a new organization. The argument is a list of names of organizations to be created. Returns an empty string on success. Options are used to specify the attributes of the newly created organization. All options are applied to all organizations in the argument.\*(f!

       Therefore do not use the -orgid option when creating two organizations with the same command, the second will fail since the orgid is already in use after the first is created. However, the -alias and -orgid options can be used to create several aliases to an existing organization with one command.

       Supports both attribute lists (with a -attribute option) and attribute options named after each attribute and policy. If an orgid is not entered, then one will be assigned to the organization automatically. A UUID should only be specified to adopt an orphaned UUID. Normally the UUID for a new organization is generated by the registry. In cases where data exists tagged with a UUID of an organization that has been deleted from the registry, it can be entered on the create command line to specify the old UUID for a new organization. The UUID specified must be an orphan, i.e., a UUID for which no name exists in the registry. An error occurs if you specify a name that is already defined in the registry. The orgid attribute may not be specified if the uuid is, but the fullname attribute may be. Examples:

       org create dce -attr {{fullname {Dist Comp Env}} \e
       {orgid 101}}
       org create dce -fullname {Dist Comp Env} -orgid 101
       org create dce -fullname {Dist Comp Env} \e
       -uuid c2aac790-dc6c-11cc-a6f8-080009251352
       

    4. organization delete

       This operation deletes the organization from the registry. When an organization is deleted, any accounts associated with that organization are deleted as well. The argument is a list of names of organizations to be deleted. If the organizations do not exist an error is generated. Returns an empty string on success.

    5. organization help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    6. organization list

       Returns a list of the names of all members of a organization. The argument is a list of names of organizations to be operated on. If more than one organization is listed, the names are concatenated together with a blank line between organizations. By default, fully qualified names are returned in the form cellname/name. If the -simplename option is given then the cellname is not prepended to the front of the member names. The members of each organization are listed in lexical order. Returns an empty string on success.

    7. organization modify

       This operation is used to change attributes and policies of organizations. To change registry-wide policies, see the registry command. The argument is a list of names of organizations to be operated on. All modifications are applied to all organizations named in the argument. Organizations are modified in the order they are listed and all modifications to an individual organization are atomic. Modifications to multiple organizations are not atomic. A failure for any one organization in a list causes an error to be generated and the rest of the operation to be aborted. Returns an empty string on success.

       The -change option can be used to modify the value of any one of the above listed attributes (except orgid and uuid) or any ERA. The value of the -change option is an attribute list describing the new values for the specified attributes. Also supports the following attribute options: -fullname, -acctlife, -pwdalpha, -pwdexpdate, -pwdlife, -pwdminlen, and -pwdspaces. Examples:

       org modify dce -attr {{fullname {Dist Comp Env}} \e
       {orgid 101}}
       org modify dce -fullname {Dist Comp Env} -orgid 101
       

       The -add and -remove options can be used to specify any ERA's, but not the above listed attributes, as each of them must always have a value.

    8. organization operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    9. organization remove

       This command is used to remove a member from a organization. The argument is a list of names of organizations to have members removed from. The value of the required -member option is a list of names of principals which will be removed from the organizations listed in the argument. When a member is removed from a organization, any accounts associated with that principal and organization are deleted.\*(f! Returns

       Remember that accounts are associated with a principal, a group, and an organization; so the statement means that any accounts where both the principal name and organization name match those given to this command are removed, but accounts where only one matches are untouched.

       an empty string on success.
    10. organization rename

        This operation changes the name of a specified organization. The argument is a single name of a principal to be renamed. Takes a required -to option with a value of the new name. The value may not be a list. Returns an empty string on success.

    11. organization show

        This operation returns an attribute list describing the specified organizations. The argument is a list of names of organizations to be operated on. If more than one organization is given, then the attributes and policies are concatenated together with a blank line between organizations. Accepts a -policies option that returns the polices of the organization instead of the attributes. If called with the -xattrs option then Extended Registry Attributes are returned instead of the above attributes. A -all option can be used to return the attributes followed by ERA's and the policies.

        Attributes are returned in the following order: fullname, orgid, uuid. Policies are returned in the following order: acctlife, pwdalpha, pwdexpdate, pwdlife, pwdminlen, and pwdspaces. If the organization does not have any policies then nopolicies is returned.

        The policies that are actually in effect can be different from the organization policies due to conflicts with registry wide policies. If this is the case, the show command will alter the attribute structure on output to include an effective tag and the effective value, much in the same way ACL's handle masks (see ACL's in the Data Structures section for details). For example:

        dcecp> org show foo -policies
        {acctlife 30 days}
        {pwdalpha no}
        {pwdexpdate none}
        {pwdlife unlimited effective 5 days}
        {pwdminlen 6}
        {pwdspaces no}
        

    account

    The account object represents Registry accounts. Each account is associated with one principal, one group and one organization. However, accounts are named by just the principal name. Aliases are differentiated for principals, so one principal can have multiple accounts under different alias names. The account has attributes to specify the group and organization of the account, these must be specified on account creation.

    Unless otherwise noted, all of the operations of this object take one argument which is a list of names of accounts (principals) to act on. They must be principal names (i.e., names relevant to the principal domain of the form /.../cellname/princname or princname to default the cellname.), not the names of the database objects that contains registry information about principals (i.e., they should not contain the string /sec/principal/). The names may be fully qualified or not, but if any are not fully qualified, then none may be. None fully qualified names refer to a principal in the cell described in _s(sec) or in the cell of the local host if _s(sec) is not set. See the principal section for a description of how the _s(sec) and _b(sec) variables are handled by this command.

    Accounts contain the following attributes:

    1. acctvalid

       A flag set to determine account validity. Possible values are either yes or no. An account with an acctvalid attribute set to no is invalid and cannot be logged into. The default is yes.

    2. client

       A flag set to indicate whether or not the account is for a principal that can act as a client. Possible values are either yes or no. If you set this flag to yes, the principal is able to log in to the account and acquire tickets for authentication. The default is yes.

    3. created

       A list of two items. The first is the principal name of the creator of the account, the second is an ISO timestamp showing the time of creation. This attribute is set by the system and may not be modified.

    4. description

       A text string (limited to PCS) typically used to describe the use of the account.

    5. dupkey

       A flag set to determine if tickets issued to the account's principal can have duplicate keys. Possible values are either yes or no. The default is no.

    6. expdate

       The date on which the account expires. To renew the account, change the date in this field. The value is an ISO timestamp or the string none. . The default is none.

    7. forwardabletkt

       A flag set to determine whether a new ticket-granting ticket with a network address that differs from the present ticket-granting ticket network address can be issued to the account's principal. The proxiabletkt attribute performs the same function for service tickets. Possible values are either yes or no. The default is yes.

    8. goodsince

       The date and time the account was last known to be in an uncompromised state. Any tickets granted before this date are invalid. The value is an ISO timestamp. When the account is initially created, the goodsince date is set to the current date.

       Control over this date is especially useful if you know that an account's password was compromised. Changing the password can prevent the unauthorized principal from accessing the system again using that password, but it does not prevent the principal that is already logged in. There is no way to cancel an already issued arbitrary ticket (you must wait for it to timeout), but you can cancel a previously issued TGT. If you set the goodsince date to the date and time the compromised password was changed, all TGT's issued before that time become invalid and the unauthorized principal will not be able to obtain new tickets.

    9. group

       The name of the group associated with the account. The value is a single group name of an existing group in the registry. This attribute must be specified on an account create command, it does not have a default value. If this group is deleted from the registry, then the account is as well.

    10. home

        The filesystem directory in which the principal is placed in at login.

    11. lastchange

        A list of two items. The first is the principal name of the last modifier of the account, the second is an ISO timestamp showing the time of the last modification. This attribute is set by the system and may not be modified directly.

    12. organization

        The name of the organization associated with the account. The value is a single organization name of an existing organization in the registry. This attribute must be specified on an account create command, it does not have a default value. If this organization is deleted from the registry, then the account is as well.

    13. postdatedtkt

        A flag set to determine if tickets with a start time some time in the future can be issued to the account's principal. Possible values are either yes or no. The default is no.

    14. proxiabletkt

        A flag set to determine whether or not a new ticket with a different network address than the present ticket can be issued to the account's principal. The forwardabletkt attribute performs the same function for ticket-granting tickets. Possible values are either yes or no. The default is no.

    15. password

        The value of this attribute is the password of the account. There is no default value, so this attribute must be specified in an account create command. This attribute is not returned by an account show command.

    16. pwdvalid

        A flag set to determine whether the current password is valid. If this flag is set to no, the next time a principal logs in to the account, the system prompts the principal to change the password. (Note that this flag is separate from the pwdexpdate policy, which sets time limits on password validity.) Possible values are either yes or no. The default is yes.

    17. renewabletkt

        A flag set to determine if the ticket-granting ticket issued to the account's principal can be renewed. If this flag is set to yes, the Authentication service renews the ticket-granting ticket if its lifetime is valid. Possible values are either yes or no. The default is yes.

    18. server

        A flag set to indicate whether or not the account is for a principal that can act as a server. Possible values are either yes or no. If the account is for a server that engages in authenticated communications, set this flag to yes. If the flag is set to no, then clients requests for tickets to contact this principal as a server will be rejected by the security server. The default is yes.

    19. shell

        The path of the shell that is executed when a principal logs in.

    20. stdtgtauth

        A flag set to determine whether or not service tickets issued to the account's principal use the standard DCE ticket-granting ticket authentication mechanism. Possible values are either yes or no. The default is yes.

    The policies are:

    1. maxtktlife

       The maximum amount of time in hours that a ticket can be valid. When a client requests a ticket to a server, the lifetime granted to the ticket takes into account the maxtktlife set for both the server and the client. In other words, the lifetime, cannot exceed the shorter of the server's or client's maxtktlife. If you do not specify a maxtktlife for an account, the maxtktlife defined as registry authorization policy is used.

    2. maxtktrenew

       The amount of time in hours before a principal's ticket-granting ticket expires and that principal must log in again to the system to reauthenticate and obtain another ticket-granting ticket. The lifetime of the principal's service tickets can never exceed the lifetime of the principal's ticket-granting ticket. The shorter you make this, the greater the security of the system. However, since principals must log in again to renew their ticket-granting ticket, the time needs to take into consideration user convenience and the level of security required. If you do not specify this for an account, the maxtktrenew lifetime defined as registry authorization policy is used.

    Supports the following operations:

    1. account catalog

       Returns a list of the names of all accounts in the registry. It takes no arguments. By default, fully qualified names are returned in the form cellname/acctname. If the -simplename option is given then the cellname is not prepended to the front of the account names. The accounts are returned in lexical order.

    2. account create

       Creates a new account. The argument is a list of names of accounts to be created. Returns an empty string on success. Options are used to specify the attributes of the newly created account. The group, organization, and password attributes must be specified on the dcecp command line (either in an attribute list or with attribute options). The password attribute may not be set when dcecp is invoked with the -c option. All options are applied to all accounts in the argument. Supports both attribute lists (with a -attribute option) and attribute options named after each attribute and policy.

       This commands requires the user to enter his or her own password to prevent a malicious user who finds a dcecp session logged in to a privileged account running from altering an existing account or creating a new account. The users password can be entered via the -mypwd option, or if not entered, the user is prompted for it as follows: Enter Your Password:. The -mypwd option may not be used if dcecp was invoked with the -c option.

    3. account delete

       This operation deletes the account from the registry. The argument is a list of names of accounts to be deleted. If the accounts do not exist an error is generated. Returns an empty string on success.

    4. account generate

       This operation contacts the password generation server to have a new password randomly generated and returned to the user. DCE 1.1 adds a password generation feature. Principals may have a pwd_val_type ERA attached to them. This defines if passwords may or must be generated for the principal they are attached too. If the ERA has the appropriate value, the account generate command will return a generated password that can be used in an account modify command Here are examples based on the three possible values for the pwd_val_type ERA:

       1. mustgen -- Password must be generated.

          dcecp> set p [account generate melman]
          newpwdfoo
          dcecp> account modify melman -password $p -mypwd -dce-
          dcecp> account modify melman -password foo -mypwd -dce-
          Error: Password must be randomly generated.
          dcecp>
          

       2. cangen -- Password may be generated.

          dcecp> set p [account generate melman]
          newpwdfoo
          dcecp> account modify melman -password $p -mypwd -dce-
          dcecp> account modify melman -password foo -mypwd -dce-
          dcecp>
          

       3. nogen -- Password may not be generated.

          dcecp> set p [account generate melman]
          Error: Password may not be generated.
          dcecp> account modify melman -password foo -mypwd -dce-
          dcecp>
          

       Note that the following should never be done since password will be changed in the account but the user will not know the value of the new password:

       dcecp> acct mod melman -password [acc gen melman] \e\
       -mypwd -dce-
       

    5. account help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    6. account modify

       This command is used to change information about an account. The -add and -remove options are not supported, as each attribute associated with an account must always have a value, however, the -change option can be used to modify the value of any one of the attributes. The value of the -change option is an attribute list describing the new values for the specified attributes. The password attribute may not be set when dcecp is invoked with the -c option.

       This commands requires the user to enter his or her own password to prevent a malicious user who finds a dcecp session logged in to a privileged account running from altering an existing account or creating a new account. The users password can be entered via the -mypwd option, or if not entered, the user is prompted for it as follows: Enter Your Password:. The -mypwd option may not be used if dcecp was invoked with the -c option.

    7. account operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    8. account show

       This operation returns an attribute list describing the specified accounts. The argument is a list of names of accounts to be operated on. If more than one account is given, then the attributes and policies are concatenated together with a blank line between accounts. Accepts a -policies option that returns the polices of the account instead of the attributes. A -all option can be used to return the attributes followed by the policies.

       Attributes and policies are returned in lexical order. If the account does not have any policies then nopolicies is returned.

       The policies that are actually in effect can be different from the account policies due to conflicts with registry wide policies. If this is the case, the show command will alter the attribute structure on output to include an effective tag and the effective value, much in the same way organization show will.

    registry

    The registry object represents the security service database of account information. The registry is a replicated database with a single master copy capable of processing both update and read requests, and zero or more slave copies capable of processing only read requests. The term replica is used to refer to either a master or slave copy of the registry. The commands in dcecp automatically bind to a registry server capable of performing a specific operation. For most operations, the user does not care which registry server is bound to, as long as the request is fulfilled. However, administrators modifying or checking the replication configuration need to be able to bind to a specific registry. The registry command can do this.

    After this command executes, the _b(sec) convenience variable is set to the name of the server that was bound to for the command. Some commands must bind to the master registry and _b(sec) will be set to reflect this. All of the commands can accept an argument, and some require one. The argument is the name of a single registry server to contact. The format of an argument and of the value of _s(sec) variable are the same and can be in one of the following formats:\*(f!

    The security API is forgiving. You can enter a cellname followed by an invalid name and you will bind to a registry server in the cell. The name that the commands set the _b(sec) variable to is always in the form of a server entry name. For example, if you set _s(sec) to /.../validcellname/bad/object/name in a cell with only one registry server, then _b(sec) will be set to /.../validcellname/subsys/dce/sec/master by the registry commands.

    1. A specific cell name (or /.: for the local cell) to bind to any replica in the named cell.
    2. The global name of a replica to bind to that specific replica in that specific cell.
    3. The name of a replica as it appears on the replica list to bind to that replica in the local cell.
    4. A string binding to a specific replica (e.g., ncadg_ip_udp:15.22.144.163), see the Bindings section for the two available syntaxes for string bindings. This form is used primarily for debugging or if the Cell Directory Service is not available.
    5. If no argument is given, then the value of _s(sec) is used. If the variable is not set, then the default argument of /.: is assumed.

    Some commands require an argument or only accept some of these formats so that any ambiguities are avoided. Arguments supersede the setting of _s(sec). The argument is used explicitly, not as a hint. If the specified server cannot handle the request, an error will be returned. The argument may not be a list of registries.

    Other dcecp objects such as: principal, group, organization, and account are used to represent most of the data in the registry. The registry object is only used for security replication configuration (i.e., sec_admin functionality) and the manipulation of registry-wide attributes (a.k.a. properties) and policies. Registry-wide policies refer to policies for organizations (standard policies in rgy_edit terminology) and accounts (see the rgy_edit auth policies command). For a list of the policies supported, see the descriptions of both the organization and the account objects.

    There are two ACL's used to allow registry operations to be performed. For those that have to deal with replication the replist object's ACL (usually /.:/sec/replist) controls access. For those that deal with registry attributes and policies, the policy object's ACL (usually /.:/sec/policy ) controls access. All of the registry operations described below deal with replication information, and as such access to them is based on the replist object, except for the modify and show operations when they are dealing with non-replication attributes.

    The list of attributes is as follows:

    1. deftktlife

       The default lifetime (in hours) for tickets issued to principals in this cell's registry. The value is an integer.

    2. mingid

       The starting point for gid's automatically generated by the Security Service when a group is created. You can explicitly enter a lower gid than this number; it applies only to automatically generated numbers. The value is an integer.

    3. minorgid

       The starting point for orgid's automatically generated by the Security Service when an organization is created. You can explicitly enter a lower orgid than this number; it applies only to automatically generated numbers. The value is an integer.

    4. minuid

       The starting point for uid's automatically generated by the Security Service when a principal is created. You can explicitly enter a lower uid than this number; it applies only to automatically generated numbers. The value is an integer.

    5. maxuid

       The highest number that can be supplied as a uid when principals are created. This maximum applies to both the system-generated and user-entered uid's. The value is an integer.

    6. mintktlife

       The minimum amount of time (in minutes) before the principal's ticket must be renewed. The value is an integer. This renewal is performed automatically with no intervention on the part of the user. The shorter this time is, the greater the security of the system. However, extremely frequent renewal can degrade system performance. Both system performance and the level of security required by the cell should be taken into consideration when selecting the value of this attribute. This is a registry-wide value only, it cannot be set for individual accounts.

    7. hidepwd

       Determines whether encrypted passwords are displayed or not. If this attribute is set to yes, an asterisk is displayed in place of the encrypted password in command output and files where passwords are displayed. Possible values are either yes or no.

    Several of the following attributes describe sequence numbers. Sequence numbers are displayed as two integers separated by a period, e.g., high.low. Both are 32 bit integers, the high is only incremented when the low wraps.

    Each registry replica keeps the following propagation information concerning registry updates:

    1. name

       The name of the replica. It is in the form of a fully qualified CDS name.

    2. type

       Indicates if the replica is a master or a slave.

    3. cell

       The name of the cell that the replica is in. It is a fully qualified cellname.

    4. uuid

       The UUID of the replica.

    5. status

       The state of the replica, one of:

       1. becomingmaster

          The replica is in the process of becoming a master.

       2. becomingslave

          The replica is a master in the process of becoming a slave

       3. changingkey

          The replica is in the process of having its master key changed.

       4. closed

          The replica is in the process of stopping.

       5. copyingdb

          The replica is in the process of initializing (copying its database to) another replica.

       6. deleted

          the replica is in the process of deleting itself.

       7. disabled

          The replica is unavailable for updates but will accept queries. This was called in maintenance by sec_admin.

       8. dupmaster

          Two masters have been found in the cell, and the replica is a duplicate of the real master.

       9. enabled

          The replica is available for use. This was called in service by sec_admin.

       10. initializing

           The replica is in the process of being initialized by the master replica or another up-to-date replica.

       11. savingdb

           The replica is in the process of saving its database to disk.

       12. unavailable

           The replica cannot be reached.

       13. uninitialized

           The database is a stub database that has not been initialized by the master replica or another up-to-date replica.

       14. unknown

           The replica is not known to the master.

    6. lastupdtime

       The localized date and time the replica was last updated.

    7. lastupdseq

       The sequence number of the last update the replica received.

    8. addresses

       A list of the network addresses of the replica. Can be more than one for connectionless and connection-oriented protocols for example.

    9. masteraddrs

       The network address of the master registry replica of the cell. This is what the replica believes, it is not necessarily correct. Can be more than one for connectionless and connection-oriented protocols for example.

    10. masterseqnum

        The master sequence number, which is the sequence number of the event that made the replica the master. This is what the replica believes, it is not necessarily correct.

    11. masteruuid

        The UUID of the master registry replica of the cell. This is what the replica believes, it is not necessarily correct. The value is a UUID.

    12. version

        The version of the security server software.

    13. updseqqueue

        The update sequence numbers that are still in the propagation queue and have yet to be propagated. This is only present in the master replica. This is a list of two numbers, the first is the base propagation sequence number, i.e., the last number known to have been received by all replicas. The second is the sequence number of the last update made on the master.

    The master replica keeps the following for each replica:

    1. name

       The name of the replica. It is in the form of a fully qualified CDS name.

    2. type

       Indicates if the replica is a master or a slave.

    3. propstatus

       The status of the propagation, possible values:

       1. delete

          The replica is marked for deletion.

       2. initmarked

          The replica is marked for initialization, that is getting an up-to-date copy of the registry.

       3. initing

          The replica is in the process of initialization, that is getting an up-to-date copy of the registry.

       4. unavailable

          The replica cannot be reached.

       5. update

          The replica is ready to receive propagation updates.

    4. lastupdtime

       The localized time the last update was sent to the replica.

    5. lastupdseqsent

       The last sequence number of the last update sent to this replica. The value is an integer.

    6. numupdtogo

       The number of outstanding updates. The value is an integer.

    7. lastcommstatus

       The status of the last communication with the replica.

    Supports the following operations:

    1. registry catalog

       Returns a list of the names of the security servers (i.e., each copy of the registry) running in the cell. This is also known as the replica list. The order is arbitrary. The _s(sec) variable may be set to point to another cell. The optional argument can specify the name of one other cell or a single string binding.

    2. registry connect

       Connects the local (default cell of local host) to the cell specified by argument. The argument is the fully qualified name of a single cell, it is not a list or a string binding. It creates an account in local cell for the foreign cell and creates an account in the foreign cell for the local cell, both with the same key.

       This command requires the following options to specify information in the local cell: -group, -org, -mypwd. It also requires the following options to specify information for the foreign cell: -fgroup, -forg, -facct and -facctpwd. Additionally, the -expdate is optional accepted to specify the expiration date of each account. Each account would be set to expire at the same time.

       This command creates the group and organization specified as the values of the four relevant options if necessary and puts the relevant principal in them if necessary. Be careful on typing, if the group or organization are misspelled they will be created. This is the same behavior as user create -force. The reason is cleanup if one group works and the second (foreign) fails, having to cleanup the local case would be difficult.

    3. registry delete

       Called with no options this command performs an orderly deletion of a security replica specified as the argument. That is, it binds to the master registry, marks the specified replica as deleted, propagates this deletion to the other replicas, sends a message to the specified replica to delete itself, and finally removes the replica from the masters replica list. The argument is required and must explicitly identify a security server, not just a cellname. The value of _b(sec) is set to the master server contacted.

       If the specified replica is unreachable, the -force option can be used. This option causes the master to delete the specified replica from the replica list and then propagates that deletion to the other replicas on the list. The specified replica is not contacted. When that replica is again accessible, the registry delete command should be called, specifying the replica and using the -only option. This causes that replica to delete its copy of the registry database and stop running. If -only is used _b(sec) is set to the name of the replica contacted. The -force and -only options may not be used together.

       Returns an empty string on success.

    4. registry disable

       Disables the master registry for updates. This is called maintenance mode in sec_admin. The argument is a single name of a registry master to be disabled. Read-only copies are not allowed, but the name of other cells can be used. If no argument is given, the value of the _s(sec) variable is used. If that is not set, the master registry of the machines default cell is used. Returns an empty string on success.

    5. registry dump

       Returns the replica information for each replica in the cell. It takes no arguments and _b(sec) is set to the name of the last replica displayed. Replicas are displayed with a blank line between them. This command is the same as the following script:

       foreach i [registry catalog] {
         lappend r [registry show $i -replica]
         append r \n
       }
       return r
       

    6. registry enable

       Enables the master registry for updates. This is called server mode in sec_admin. The argument is a single name of a registry master to be enabled. Read-only copies are not allowed, but the name of other cells can be used. If no argument is given, the value of the _s(sec) variable is used. If that is not set, the master registry of the machines default cell is used. Returns an empty string on success.

    7. registry help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    8. registry modify

       This command is used to change attributes and policies of the registry. The master registry is always the one contacted to fulfill the request. If no argument is given, _s(sec) is used as a hint, if it is a replica, the master of the cell of the replica is contacted. If an argument is specified it is assumed to be an explicit request to contact that server, if a replica is specified and not a master, an error is returned. Returns an empty string on success.

       The -change option can be used to modify the value of any one of the above listed attributes and policies. The value of the -change option is an attribute list describing the new values for the specified attributes. Also supports attribute options. The -add and -remove options are not supported as each of the above attributes and policies must always have a value.

       Each replica (master and slave) maintains its own master key used to access the data in its copy of the database. This command accepts the -key option to generate a new master key for the replica named in the required argument and to re-encrypt account keys using the new key. The new master key is randomly generated. If -key is used other options may not be used. This option requires that a single registry be named as an argument.

    9. registry operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    10. registry set

        Changes which replica is the master. The argument is the name of a single registry replica. If called with no options, the command changes the replica named in the argument to be the new master for the cell and changes the existing master to be a slave. Can also be called with either a -slave or -master option in which case it changes the type of replica specified as an argument to what the option specifies. If the -master option is used, the system checks other slaves to see if they are more up-to-date than the one specified in the argument. If any are, the command fails with an error unless the -force option is used.

        The value of _b(sec) is set in the following ways. If called with no options, then it is set to specify the old master replica. If called with either -slave or -master then it is set to the replica specified in the argument. Returns the empty string on success.

    11. registry show

        Returns information about the registry and its replicas. Takes an optional argument specifying a single registry replica to contact. Specifying an argument is the same as setting the _s(sec) convenience variable before executing a registry show command without any argument.

        Returns a variety of different information based on the option given. If called with no options or with the -attributes option, returns an attribute list in alphabetical order of all the registry-wide attributes. If called with the -xattrs option then Extended Registry Attributes are returned instead of the registry-wide attributes. If called with the -policies option, returns an attribute list in alphabetical order of all the registry-wide polices. For example:

        dcecp> rgy sho -at
        {deftktlife +0-10:00:00.000I-----}
        {hidepwd yes}
        {maxuid 32767}
        {mingid 5100}
        {minorgid 100}
        {mintktlife +0-00:05:00.000I-----}
        {minuid 12429}
        dcecp> rgy sho -po
        {acctlife unlimited}
        {maxtktlife +1-00:00:00.000I-----}
        {maxtktrenew +28-00:00:00.000I-----}
        {pwdalpha yes}
        {pwdexpdate none}
        {pwdlife unlimited}
        {pwdminlen 0}
        {pwdspaces yes}
        

        If called with the -replica option, returns the propagation information that is kept by the replica specified in the argument or in _s(sec). For example:

        dcecp> rgy sho -re
        {name /.../absolut_cell/subsys/dce/sec/master}
        {type master}
        {cell /.../absolut_cell}
        {uuid 91259b6c-9415-11cd-a7b5-080009251352}
        {status enabled}
        {lastupdtime 1994-07-05-14:38:15.000-04:00I-----}
        {lastupdseq 0.191}
        {addresses
         {ncacn_ip_tcp 130.105.5.93}
         {ncadg_ip_udp 130.105.5.93}}
        {masteraddrs
         {ncacn_ip_tcp 130.105.5.93}
         {ncadg_ip_udp 130.105.5.93}}
        {masterseqnum 0.100}
        {masteruuid 91259b6c-9415-11cd-a7b5-080009251352}
        {version secd.dce.1.0.2}
        {updseqqueue {0.187 0.191}}
        

        Can also be called with the -master option, in which case the master is contacted and the propagation information that the master keeps for each slave is returned. In this case the argument if present, be a master or a cellname or an error is returned. If there is no argument the master of the local cell is contacted.

        All the options to this command are mutually exclusive.

    12. registry stop

        Stops the security server process specified in the argument. The argument is required and must explicitly identify one replica (i.e., just a cellname is not valid). The _b(sec) variable is set to the name of the specified replica.

    13. registry synchronize

        Causes the specified replica to reinitialize itself with an up-to-date copy of the database. The required argument is a name of a single registry replica to operate on. This command binds to the master, marks the specified replica for reinitialization, sends a message to the replica informing it to reinitialize itself and providing a list of other replicas with up-to-date copies of the registry. The specified replica then selects a replica from the list and asks for a copy of the database. The _b(sec) variable is set to the name of the master replica contacted.

        This command is generally not used under normal circumstances. Mainly because the registries should remain synchronized. Also there will be functionality in the DCE 1.1 secd such that if the master loses contact with a slave for a protracted period of time, the master reinitializes the slave automatically by giving it a fresh copy of the entire database when communication is restored. In pre-1.1 versions of DCE, if the master loses contact with the slave you must explicitly use the registry synchronize or the sec_admin initrep command to perform this function.

    14. registry verify

        Checks if all registry replicas are up-to-date. Returns and empty string if they are. If not, a list of out-of-date and unreachable replica names (or bindings if names are not available) is returned. This elements of this list are suitable use in a foreach loop around a call to a registry synchronize command.

    xattrschema

    The xattrschema object represents the schema information for an extended registry attribute (ERA). Extended registry attributes may be attached to principals, groups, organizations, and registry-wide policies, as well as on server configuration and server execution objects supported by dced. The operations of other dcecp objects can manipulate ERA instances, this object is used to manipulate the definition of the schema of these attributes.\*(f!

    The word attribute is very overused in this section, but the meaning should be clear by context. An ERA on an object is referred to as an ERA. Each ERA type has a schema entry. Each schema entry has various attributes.

    Each ERA that can be added to some object, has a type and possibly a value. The definition of the type is stored in the schema. Each ERA type has one ERA schema object associated with it. For ERA's in the registry, these schema objects have the name: /.:/sec/xattrschema/typename.\*(f! The

    The /.:/sec is not fixed, it can be different for each cell, though this is the default setting as shipped by OSF.

    argument to these commands is a list of names of schema objects of this form. For ERA's in dced these schema objects have the name: /.:/hosts/hostname/xattrschema.

    Each ERA type is defined to be attachable to a specific object type. The object type is identified by the UUID of the ACL manager for that object type. This ensures that the naming mechanism used to identify the object for purposes of manipulating its ACL is the same as that used to manipulate its ERA's.

    Each ERA schema object has the following attributes:

    1. aclmgr

       A set that lists the ACL managers that support the object types on which ERA's of this type can be created. For each ACL manager type, the permissions required for attribute operations are also specified. Each acl manager is described with a list, the format is:

       uuid queryset updateset testset deleteset
       

       where the first is the UUID of the ACL manager, and the rest are the sets of permissions (contentated permission strings as found in an ACL) required to perform each type of operation. The value of this attribute is actually a list of these lists. For example:

       {8680f026-2642-11cd-9a43-080009251352 r w t D}
       {18dbdad2-23df-11cd-82d4-080009251352 r w t mD}
       

       This attribute is modifyable after creation, but only in a limited way. New ACL managers can be added, but existing ones cannot be removed or changed. This attribute is required but has no default value.

    2. annotation

       This is a comment field used to store information about the schema entry. It is a PCS string, the default is the empty string.

    3. applydefs

       Indicates that if an ERA on a given principal is not found, the related organization (of the account) should be check for that ERA and it's value used.\*(f! If

       In future versions of DCE, ERA's will be able to be attached to the policy object, and used as cell-wide defaults for all types of objects.

       set to no, an attribute query will return an attribute instance only if it exists on the object named in the query. The possible values are either yes or no, the default is no.

       This attribute is only advisory in DCE 1.1. Future versions of DCE will support this functionality.

    4. encoding

       The data type of the ERA value. This attribute is not modifiable after creation. It is a required attribute and has no default value. Legal values are one of:

       1. any

          The value of the ERA can take on any encoding. This encoding type is only legal for the definition of an ERA in a schema entry. All instances of an ERA must have a concrete encoding type (i.e. any encoding except any).

       2. attrset

          The value of the ERA is a list of attribute type UUID's used to retrieve multiple related attributes by specifying a single attribute type on a query.

       3. binding

          The value of the ERA contains authentication, authorization and binding information suitable for communicating with a DCE server.

          The syntax is a list of two elements. The first is a list of security information where the first element is the authentication type, either none or dce, followed by information specific for each type. The type none has no further info. The type dce is followed by a principal name, a protection level (one of default, none, connect, call, pkt, pktinteg, or pktprivacy), an authentication service (one of default, none, or secret), and an authorization service (one of none, name, or dce). Three examples of the security information list are:

          {none}
          {dce /.:/melman default default dce}
          {dce /.:/melman pktprivacy secret dce}
          

          The second is a list of binding information, where binding information can be string bindings (see the Bindings section), server entry names or binary representations of the network representation of a tower. Three examples of binding information are:

          {/.:/hosts/hostname/dce-entity
           /.:/subsys/dce/sec/master}
          {ncadg_udp_ip:130.105.96.3[1234]
           ncadg_udp_ip:130.105.96.6[1234]}
          {00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f \e
          10 11 12 13
           22 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f \e
          12 11 12 13}
          

       4. byte

          The value of the ERA is a string of bytes. The byte string is assumed to be pickle or is otherwise a self describing type. It is expected that attributes of this type will usually not be entered manually. The format of output is hex bytes separated by spaces with 20 bytes per line.\*(f! For

          Tcl allows binary data to be entered via backslash substitution using one of two notations: \exhh or \eooo. These are not used to display binary data by dcecp so that Tcl will not transform the data while manipulating it. For example, if an ERA was returned as \ex41, a variable set to that returned value, such as _r would pass it through the interpretor and have backslash substitution performed and be set to the string A.

          example, suppose the attribute name was bindata:

          {bindata
           {00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f \e
          10 11 12 13
            22 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f \e
          12 11 12 13}}
          

          The braces indicate that bindata has one value. Passing the above attribute to llength would return 2. On input all white spaces will be compressed so that users may enter the data as bytes or words or any combination, whichever is more convenient. Therefore a user could enter the following as input:

          {bindata
           {00010203 0405 06070809 0a0b 0c0d0e0f 10111213
            22212223 2425 26272829 2a2b 2c2d2e2f 12111213}}
          

       5. i18ndata

          The value of the ERA is a string of bytes with a tag identifying the (OSF registered) codeset used to encode the data. See [RFC 40]. The syntax is a Tcl list where the first element is the codeset identifier; it is either a 32-bit integer or string name as obtained from the codeset registry. The second element of the list is the actual string in the specified codeset.

       6. integer

          The value of the ERA is a signed 32 bit integer.

       7. printstring

          The value of the ERA is a printable IDL character string using PCS.

       8. stringarray

          An array of PCS strings; represented as a Tcl list of strings.

       9. uuid

          The value of the ERA is a UUID.

       10. void

           The ERA has no value. It is simply a marker that is either present or absent. ERA's of this encoding type are displayed as having a value present. This is so they are easier to deal with in an attribute list format. If the ERA is not present on an object then it is not displayed at all, as opposed to being displayed with a value notpresent.

           The value present should be used when adding the ERA via either the create -attribute or the modify -add constructs. It may be used for the modify -remove construct but is not necessary. If the value is not used it means to remove the entire attribute, if it is used it means remove the value from the attribute, but since it is in some sense the last value of the attribute, the attribute is removed. The modify -change construct is unimportant since the ERA has no value and cannot be changed.

           Pseudo examples follow:

           dcecp> pgo create -attribute {void_era present}
           dcecp> pgo modify -add {void_era present}
           dcecp> pgo modify -remove {void_era}
           dcecp> pgo modify -remove {void_era present}
           dcecp> pgo show  # if ERA is not present
           dcecp> pgo show  # if ERA is present
           {void_era present}
           

    5. intercell

       Specifies the action that should be taken by the Privilege Server when reading ERA's from an EPAC from foreign cell. Possible values are:

       1. accept -- accepts ERA's from foreign cells. The only check applied is uniqueness if indicated by the unique attribute.
       2. reject -- discards ERA's from foreign cells. This is the default.
       3. evaluate -- invokes a trigger function to a server that will decide whether the ERA should be kept, discarded or mapped to another value.

       This attribute is only advisory in DCE 1.1. Future versions of DCE will support this functionality.

    6. multivalued

       Indicates that ERA's of this type may be multi-valued (i.e., multiple instances of the same attribute type may be attached to a single object). The possible values are either yes or no. This attribute is not modifiable after creation and defaults to no.

    7. reserved

       If set then this schema entry may not be deleted through any interface by any user. The possible values are either yes or no. It defaults to no.

    8. scope

       The value of this attribute is the name of a security directory or object in the registry. If it is an object, then only that object may have instances of this ERA attached to them. If it is a directory, then only descendants of this directory may have instances of this ERA attached to them. The default is an empty string which does not limit which objects ERA's may be attached to. E.g., if this attribute is set to principal/osf/dce only principals with a prefix of osf/dce in the name may have this type of ERA.

       This attribute is only advisory in DCE 1.1. Future versions of DCE will support this functionality.

    9. trigtype

       Identifies if there is a trigger and if so what type it is. The possible values are one of: none, query, or update. If this attribute is anything other than none, then trigbind must be set. This attribute is not modifiable after creation and the default is none.

    10. trigbind

        Contains binding information for the server that will support the trigger operations. This field must be set if trigtype is not none or if intercell is set to evaluate. The value of this attribute is of the format described by the binding encoding. It defaults to the empty string.

    11. unique

        Indicates that each instance of the ERA must have a unique value within the cell for a particular object type (e.g., principal). The possible values are either yes or no. This attribute is not modifiable after creation and defaults to no.

        This attribute is only advisory in DCE 1.1. Future versions of DCE will support this functionality.

    12. uuid

        The internal identifier of the ERA. The value is a UUID. This attribute is not modifiable after creation. If not specified on the create command, a value is generated by the system.

    Supports the following operations:

    1. xattrschema catalog

       This operation returns a list of all the schema entries defined in the service. The service is specified by an argument as on other xattrschema operations. Returns fully qualified names by default. The -simplename option will return only the last component of the names.

    2. xattrschema create

       Creates a new schema entry for an ERA. The argument is a list of names of schema entries to be created. Attributes for the created schema entries can be specified via attribute lists (with a -attribute option) and attribute options. All atributes are applied to all entries to be created. If a name is given, the uuid attribute may not be specified since each ERA must have a unique UUID. Returns an empty string on success.

    3. xattrschema delete

       This operation deletes a schema entry. The argument is a list of names of schema entries to be deleted. If they do not exist an error is generated. This command also deletes all ERA instances of the schema entry. Returns an empty string on success.

    4. xattrschema help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. xattrschema modify

       This operation is used to change attributes of schema entries. The argument is a list of names of schema entries to be operated on. All modifications are applied to all schema entries named in the argument. Schema entries are modified in the order they are listed and all modifications to an individual schema entry are atomic. Modifications to multiple schema entries are not atomic. A failure for any one schema entry in a list causes an error to be generated and the rest of the operation to be aborted. Returns an empty string on success.

       The -change option can be used to modify the value of any one of the attributes that is described as modifiable above.\*(f! Its

       The -add and -remove options are not supported, as each attribute associated with a schema entry must always have a value.

       value is an attribute list describing the new values for the specified attributes.

       Attribute options are supported as well.

    6. xattrschema operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. xattrschema rename

       This operation changes the name of a specified ERA. The argument is a single name of an ERA to be renamed. Takes a required -to option with a value of the new name. The value may not be a list. Returns an empty string on success.

    8. xattrschema show

       This operation returns an attribute list describing the specified schema entries. The argument is a list of names of schema entries to be operated on. If more than one schema entry is given, then the attributes are concatenated together with a blank line between schema entries. Attributes are returned in alphabetical order.

    acl

    The acl object represents an ACL which may be on any object. The acl_edit use model is a batched one. Each acl_edit session modifies the ACL on one object. The commands are structured so that individual ACL Entries are modified locally, but nothing is written back to the server until either a commit or exit command is performed. This model will not be followed in dcecp. Each acl command will write to the server, however, commands will allow more than one modification at once.

    ACL's are composed of ACL Entries. ACL Entries are visible only as members of ACL's. There is no object that represents ACL Entries, only the acl object representing an entire ACL. Most of the acl operations deal directly with the ACL. See the Data Structures section for a description of the syntax of ACL's and ACL Entries. An ACL does have one attribute which represents the default cell of the ACL; it is called cell. Manipulation of this attribute is possible only through the modify and show commands.

    An object can have more than one ACL. If the object is a container it has three ACL's: the ACL for the container object itself, an ACL specifying the default ACL on new objects added to the container (the initial object ACL), and an ACL specifying the default ACL on new containers added to the container (the initial container ACL). By default the acl command will bind to the ACL of the container. The other ACL's can be operated upon by using options on the commands.

    In addition there is another ambiguity that can occur in identifying the ACL to operate on. Since entries in the namespace often identify resources that have ACL's (e.g. servers sometimes have ACL's and they export their binding information into an RPC Entry) the name of a object can mean either the object itself or the namespace entry that identifies the object. This ambiguity is also solved by using a option.

    The options that specify the ACL to edit can be given on any of the operations and are as follows:

    1. -ic

       Specifies that the command is to operate on the initial container ACL of the named object.

    2. -io

       Specifies that the command is to operate on the initial object ACL of the named object.

    3. -entry

       Specifies that the command is to operate on the ACL of the namespace entry of the object.

    4. -type

       Specifies a particular ACL manager to use. Unneeded in most cases, required where polymorphic objects are supported (in DCE 1.1 this is in principal names and principal directories). Accepts as a value the name of a single ACL manager. This name can be obtained from doing an acl show -managers command.

    The above options are not mutually exclusive (with the exception of -ic and -io). For example, to edit the initial object ACL of a principal directory that is also a principal you need to use the -io and -type options.

    The acl command is called with one argument which is a list of items specifying the ACL's to be modified. Each item can be either the name (most common) or a list of a string binding (see the Bindings section) with a residual name appended to identify the object.\*(f! Any

    This is used for cell initialization and not too many other times.

    options used to specify an ACL to operate upon apply to all items entered in the list.

    Supports the following operations:

    1. acl check

       Returns the permissions granted in the specified object's ACL to the principal that invoked the command. The argument is a list of names of ACL's to be operated on. This command accepts the -entry and -type options, but not the -io or -ic options. The check command returns the permissions the user has to the object, the only ACL needed to resolve this issue, is the permission ACL on the object. The -entry option is supported since it describes which object is involved, not merely which ACL on an object is involved.

       dcecp> acl check /.:/hosts
       rwdtcia
       dcecp> acl check /.:/subsys /.:/hosts
       r--t-ia
       rwdtcia
       

    2. acl delete

       Removes all ACL Entries from the object, except the user_obj entry, if it exists. Note that not all acl managers support the user_obj ACL entry. If this commands is performed on an ACL which is not capable of having a user_obj ACL entry, or just does not have one (resulting in an empty ACL), the correct response from the ACL manager is a bad syntax error.\*(f! The

       In general, this operation is not very useful, except for ACL's on file system objects such as files in Episode filesystems.

       argument is a list of names of ACL's to be operated on. Generates an error if the ACL does not exist. Returns an empty string on success.
    3. acl help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. acl modify

       This operation is used to change one or more individual ACL entries. The argument is a list of names of ACL's to be modified. They are processed in the order they are entered. The specific operation to perform is described with one or more of the following options:

       1. -add

          Adds the ACL Entries to the ACL. The value of this option is a list of ACL Entries with permissions filled in.

       2. -remove

          Removes the ACL Entries from the ACL. The value of this option is a list of ACL Entries without permissions filled in.

       3. -change

          Changes existing ACL Entries in the ACL. The value of this option is a list of ACL Entries with permissions filled in. The permissions will be the new permissions placed on the specified ACL Entries. The ACL Entries must exist in the ACL or an error occurs.

       4. -purge

          Purges all masked permissions (before any other modifications are made), in all ACL Entries except: user_obj, other_obj, mask_obj, and unauthenticated if they exist. This option is useful only for ACL's that contain an entry of type mask_obj.

       5. -mask

          If a modify operation causes a mask recalculation that unintentionally adds permissions to an existing acl entry, the modify operation will abort with an error unless you specify the -mask option with a value of either calc or nocalc, or a unique abbreviation of one of these values.

          Specifying calc creates or modifies the object's mask_obj type entry with permissions equal to the union of all entries other than type user_obj, other_obj, mask_obj and unauthenticated. This creation or modification is done after all other modifications to the ACL are performed. The new mask is set even if it grants permissions previously masked out. It is recommended that you use this option only if not specifying it results in an error. If you specify the calc option for an ACL that does not support mask_obj entry type, an error is returned.

          Specifying nocalc means that a new mask should not be calculated.

          This option is only legal if the -add or -change option is present on the modify command. The ACL must support the mask_obj ACL type, or else an error is returned. If the user explicitly includes a mask_obj ACL entry in the command (i.e., in the value of the -add or -change options), the use of the -mask option is illegal. The reason is that the -mask option is meant to resolve unintentional results, the presence of a mask_obj ACL entry implies intent.

       Either all changes are made to an individual object, or none are. Multiple actions can be specified on the command line, they will be processed in a fixed order to guarantee proper processing of the ACL's. See [POSIX.6] for a description of this processing order. The command returns an empty string on success. Examples are:

       dcecp> acl modify /.:/hosts -add {user melman rwcia}
       dcecp> acl modify /.:/hosts -change {user melman rwdtcia}
       dcecp> acl modify /.:/hosts -add {group dce rwdtcia} \e
       -remove {user melman rwdtcia}
       

       The modify operation can change the value of the cell attribute using an attribute option called -cell and giving the new default cell as the value (it must be one value, not a list):

       dcecp> acl modify /.:/hosts/ -cell /.../newcell
       dcecp> acl modify /.:/hosts/ -add {user melman rwcia} \e
       -cell /.../newcell
       

       The -cell option may be combined with other options on a single modify command. It is always applied before the other options. Note that changing the default cell of an ACL that has user or group ACL entries, or their delegate counterparts, can be dangerous. The principal and groups mentioned in these ACL entries must be in the default cell. If the default cell changes these ACL entries must as well. The acl modify command applies the change of cell first and then the change to the ACL entries. This will not work if there are ACL entries of the above types, instead the acl replace command should be used to change both the cell and the ACL entries at the same time. The -cell option of the acl modify command can be useful if there are no ACL entries of the above type, or if the ACL is in an incorrect state and must be corrected.

    5. acl operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    6. acl permissions

       Returns a list describing the permissions associated with an object. The argument is a list of names of ACL's to be operated on. If more than one is entered the output is concatenated together with a blank line between ACL's. Each element of the list is a list of two items, the first is the permission token, the second is a description of the permission. For example:

       dcecp> acl permissions /.:/hosts
       {r read}
       {w write}
       {d delete}
       {t test}
       {c control}
       {i insert}
       {a administer}
       

    7. acl replace

       Replaces the entire ACL on the object specified by the argument, with the value of the required -acl option. The argument is a list of names of ACL's to be operated on. The syntax of the value of the -acl option is a list of ACL entries. Also takes a -cell option to specify the new default cell of the ACL. It's value is the name of one cell only (it is not a list). Returns an empty string on success.

    8. acl show

       Returns a list of the ACL Entries for the specified object. The argument is a list of names of ACL's to be operated on. If more than one is given the output is concatenated together with a blank line between ACL's. If they exist, the mask_obj and unauthenticated ACL Entries are displayed first. For example:

       dcecp> acl show /.:/hosts
       {unauthenticated r--t---}
       {user cell_admin rwdtcia}
       {user hosts/absolut/cds-server rwdtcia}
       {user hosts/absolut/self rwdtcia}
       {user root rwdtcia}
       {group subsys/dce/cds-admin rwdtcia}
       {group subsys/dce/cds-server rwdtcia}
       {any_other r--t---}
       

       Note that since UUID's and not names are stored in ACL's, dcecp may not be able to determine the name associated with an ACL entry, in this case, the UUID will be returned as the key. For example, this can be caused if the default cell stored in the ACL (also as a UUID) is incorrect, (i.e., it doesn't refer to a real cell), or the users and groups mentioned in user and group ACL entries aren't registered in the default cell.

       If called with the -cell option returns the value of the default cell for the ACL, preferrably as a name but as a UUID if this is not possible:

       dcecp> acl show /.:/hosts -cell
       /.../absolut_cell
       

       If called with the -managers option returns the names of ACL managers supported for the object. These names may be used as the value of a -type option to other acl commands. The following example uses potentially fictitious results, the names of the ACL managers have not yet been determined.

       dcecp> acl show /.:/sec/principal/melman -managers
       principal secdirectory
       

       There is no -all option.

    dts

    The dts object represents the dtsd process running on a host. Since DTS is designed not to have stored data, this object represents the information in and about a process rather than some data stored somewhere as other objects do. Also this is not implemented as an instance of the server object (described below) since objects, not instances, have operations associated with them.

    These commands all affect the local dtsd entity by default. If given an argument they can affect a remote DCE 1.1 dtsd. The argument is a single server entry or string binding representing a dtsd that will be contacted for the operation. If the _s(dts) convenience variable is set, it is treated as the name of a dtsd to contact for this operation. If either of these methods is used, the specified server is the only server that will be contacted in an attempt to complete the operation. The argument on the command line, takes precedence over the value of the _s(dts) convenience variable. These commands do not set the value of this variable after completion.

    There are a number of attributes associated with the dts object. All of these can be viewed with the show operation, and many can be changed with the modify operation. Attribute arguments can contain a maximum of 80 characters and are recalculated to a normalized date format. For example if the input value is 0-0025:10:99.99999999, the result is 1-01:11:39.990.

    The attributes are:

    1. autotdfchange

       Specifies whether automatic changes to the time differential factor are enabled or disabled. The value is either yes or no. The value is determined by the operating system (i.e., it cannot be changed with the modify operation).

    2. clockadjrate

       Specifies the rate at which the DTS server or clerk entity adjusts the node's clock during a synchronization. This may not be set by a user, but is built into dtsd.

    3. clockresolution

       Specifies the amount of time between system clock ticks. The value is determined by the operating system (i.e., it cannot be changed with the modify operation).

    4. globalservers

       Specifies the set of global servers known by the node. The information returned for each server is as follows: the DCE name of the host followed by /self, the last time polled, the last observed time, the last observed skew, a binary value of whether the server was used in the last last synchronization, and the transport time. The sub-attributes are respectively called: name, timelastpolled, lastobstime, lastobsskew, inlastsync, and transport.

    5. globaltimeout

       Specifies the amount of time the node waits for a response to a WAN synchronization request before sending another request or declaring a global server to be unavailable. The number of attempts made to reach the server is controlled by the queryattempts attribute. The default value is 0-00:00:15.000, and the range of possible values is 0-00:00:00.000 - 0-00:10:00.000.

    6. localservers

       Specifies the set of local servers known by the node. The information returned for each server is as follows: the DCE name of the host followed by /self, the last time polled, the last observed time, the last observed skew, a binary value of whether the server was used in the last last synchronization, and the transport time. The sub-attributes are respectively called: name, timelastpolled, lastobstime, lastobsskew, inlastsync, and transport.

    7. localtimeout

       Specifies the amount of time the node waits for a response to a synchronization request before sending another request or declaring a server to be unavailable. The number of attempts made to reach the server is controlled by the queryattempts attribute. The default is 0-00:00:05.000, and the range of possible values is 0-00:00:00.000 - 0-00:01:00.000.

       Note that this attribute controls only the initial contact with a time provider. During this initial contact, the time provider itself determines the timeout value for actually reporting back times. This allows a time provider attached to a slow source like a modem to request that dtsd wait for a longer interval.

    8. maxdriftrate

       Specifies the worst-case drift rate of the node's clock, in nanoseconds per second, as determined by the manufacturer's specifications (i.e., it cannot be changed with the modify operation).

    9. maxinaccuracy

       Specifies the inaccuracy limit for the node. When the node exceeds the maximum inaccuracy setting, it attempts to synchronize. The default is 0-00:00:00.100, and the range of possible values is 0-00:00:00.0 - 10675199-02:48:05.478.\*(f!

       This has been changed to be a max of 24 hours as per DCE OT 7357. It really makes no sense for this value to be anything other than seconds.

    10. minservers

        Specifies the minimum number of servers required for a synchronization. Settings of 1 or 2 may cause unreliable computed times. The default is 3 and the range of possible values is 1-10.

    11. nexttdfchange

        Specifies the future time at which the time differential factor is automatically changed. The value is determined by the operating system (i.e., it cannot be changed with the modify operation).

    12. queryattempts

        Specifies the number of attempts that a node makes to contact a server before the node considers the server unavailable. The default is 3, and the range of possible values is 1-10.

    13. syncinterval

        Specifies the interval a node must wait to synchronize. Also specifies synchronization frequency when a node reaches the value specified by the maxinaccuracy attribute. For clerks the default is 0-00:10:00.0, and the range of possible values is 0-00:00:30.0 - 01 00:00:00.00. For servers the default is 0-00:02.00.0, and the range of possible values 0-00:00:30.0 - 01 00:00:00.00.

    14. tdf

        Specifies the Time Differential Factor (TDF), which is the amount of time the server varies from Greenwich mean time (GMT) or Coordinated Universal Time (UTC). The default is 0-00:00:00.000, and the range of possible values is -13-00:00:00 - 13-00:00:00. This may not be set by a user, but rather is obtained from various timezone information repositories (e.g., the TZ environment variable, kernel structures, etc.).

    15. timerep

        Specifies the internal timestamp format used by the node. This is not related to the format that is used to display the current time to the user (see the clock show command below). Currently DTS only uses V1.0 timestamps. This attribute may not be set by the user, its value is built into a dtsd.

    16. tolerance

        Specifies the maximum separation allowed between the local clock and the computed time before synchronizations become abrupt rather than gradual (monotonic). The default is 0-00:05:00.000, and the range of possible values is 0-00:00:00.500 - 10675199-02:48:05.478.

    17. type

        Specifies whether the node is a DTS server or clerk.

    18. version

        Specifies the DTS software version installed on the node. This attribute cannot be changed with the modify operation.

    Additional attributes on a server are:

    1. actcourierrole

       Specifies a server's acting interaction with the set of global servers. The values are the same as for the courierrole attribute below. The difference between this attribute and that, is when courierrole is backup, the courier could be actually acting as a courier or not.

    2. checkinterval

       Specifies the amount of time between checks for faulty servers. Applicable only to servers that have external time providers. The default is 0-01:30:00.00, and the range of the possible values is 0-00:00:30.000 - 10675199-02:48:05.478.

    3. courierrole

       Specifies a server's interaction with the set of global servers. Possible values are:

       1. backup

          The local server becomes a courier if none are available on the LAN. This is the default.

       2. courier

          The local server synchronizes with the global set of servers.

       3. noncourier

          The local server does not synchronize with the global set of servers.

    4. epoch

       Specifies the server's epoch number. The default is 0, and the range of possible values is 0-255. This value may not be changed via the modify command; use the clock set command with the -abruptly and -epoch options to change its value.

    5. lastsync

       Specifies the computed time at the start of the last attempted synchronization.

    6. provider

       Specifies whether or not the entity used an external time-provider at the last successful synchronization. This attribute applies to servers only and may not be set by a user. The value is either yes or no.

    7. serverentry

       Specifies a server's ACL entry name. The default setting is the following recommended value: /.:/hosts/hostname/dts-entity.

    8. servergroup

       Specifies the security group name for the time servers within the cell. The default is /.:/subsys/dce/dts-servers.

    9. serverprincipal

       Specifies a server's principal name for authentication purposes. The default setting is the following recommended value: /.:/hosts/hostname/self.

    10. status

        Specifies the state of the DTS entity. This is a read-only attribute and its possible values are:

        1. disabled -- The DTS entity is disabled.
        2. enabled -- The DTS entity is enabled.
        3. syncing -- The DTS entity is synchronizing.
        4. updating -- The DTS entity is updating the time.
    11. uuid

        Specifies the entity's unique identifier, which is generated when the entity is created.

    The counters are:

    1. abrupts

       Specifies the number of times the node clock has been set non-monotonically (abruptly).

    2. badlocalservers

       Specifies the number of times that a local server was contacted, but it was not in the dts security group.

    3. badprotocols

       Specifies the number of times the local node failed to process a received message containing an incompatible protocol version.

    4. badtimereps

       Specifies the number of times the local node failed to process a received message containing an incompatible timestamp format.

    5. creationtime

       Specifies the time at which the DTS entity was created and the counters were initialized.

    6. disables

       Specifies the number of times the DTS has been disabled.

    7. enables

       Specifies the number of times the DTS has been enabled.

    8. nointersections

       Specifies the number of times the node's time interval failed to intersect with the computed interval of the servers.

    9. nomemories

       Specifies the number of times the node has been unable to allocate virtual memory.

    10. providertimeouts

        Specifies the number of times a dtsd server process initiated contact with a time provider and did not receive the initial response within the interval specified by the localtimeout attribute.

    11. syncs

        Specifies the number of times the node successfully synchronized.

    12. syserrors

        Specifies the number of times a DTS process detected a system error.

    13. toofewservers

        Specifies the number of times a node failed to synchronize because it could not contact the required minimum number of servers.

    Additional counters on a server are:

    1. badservers

       Specifies the number of times that a non-local server was contacted, but it was not in the dts security group.

    2. diffepochs

       Specifies the number of times the node received time response messages from servers or clerks that had epoch numbers different from its own.

    3. epochchanges

       Specifies the number of times the server's epoch has changed.

    4. faultyservers

       Specifies the number of times a server has detected faulty servers (other than itself).

    5. noglobals

       Specifies the number of times the courier server could not contact any global servers.

    6. noresponses

       Specifies the number of times the courier server could not contact a specific global server.

    7. providerfailures

       Specifies the number of times the external time-provider signaled a failure or the node was unable to access the time-provider.

    8. syncattempts

       Specifies the number of times a server has attempted to synchronize its clock.

    Supports the following operations:

    1. dts activate

       Changes a DTS entity from an inactive state to an active state. The status attribute is changed to enabled. This tells the DTS entity to begin synchronizing. Takes a -abruptly option to determine if the first clock adjustment due to synchronization is an abrupt or gradual one. Returns an empty string on success.

    2. dts catalog

       Returns a list of the names of all DTS servers in the specified cell. The optional argument is the name of a cell to look in, it defaults to /.:. The names are returned in lexical order. The names returned are fully qualified (i.e., they include the cell name) unless the -simplename option is used.

    3. dts configure

       Requires one of two options -global or -notglobal to configure the local dtsd as a global server or not. The difference is whether they are listed in /.:/cell-profile. Returns the string global or notglobal to indicate the current (new) state of the dtsd.

    4. dts deactivate

       Changes a DTS entity from an active state to a deactive state. The status attribute is changed to disabled. This tells the DTS entity to stop synchronizing. Returns an empty string on success.

    5. dts help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    6. dts modify

       Allows attributes to be changed with the -change option. Attribute options are also supported for all modifiable attributes. Returns an empty string on success.

    7. dts operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    8. dts show

       When called with the -attributes returns an attribute list giving the values of the attributes listed above. If called with the -counters option then counter information is returned. If called with the -all or with both the -attributes and -counters options then both attribute and counter information is returned. The default behavior (invoked by using no options) is the same as if the -attributes option was used. Attributes and counters are listed in the order they are returned by the server.

    9. dts stop

       This stops the dtsd process. Returns an empty string on success.

    10. dts synchronize

        Causes the local dtsd to synchronize with DTS servers. The machine's clock is adjusted accordingly. By default the clock is adjusted gradually. This command also takes the optional -abruptly option to have the clock set abruptly. Returns an empty string on success.

    clock

    The clock object represents the clock on a system, and the time that it tells. This object has commands to display and set the time. The time setting commands are done via DTS. The optional argument to these commands is name of a dtsd running on some machine. Without an argument the _s(dts) convenience variable is checked. If not set, operates on the clock on the local machine.

    Supports the following operations:

    1. clock help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    2. clock operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    3. clock set

       Sets the clock to the time specified as the value of the -to option. Can also change the epoch of the DTS server via the -epoch option. The argument can be the name of a DTS entity to set the clock on another host. If no argument is given the value of _s(dts) is checked. If that is not set, the local clock is set. The clock is adjusted gradually by DTS to the specified time. This command takes a -abruptly option which specifies that the time is to be immediately changed to the specified time. When this option is present the -epoch option must also be specified to indicate a new epoch. Returns an empty string on success. Requires w permission on the DTS entity.

    4. clock show

       Returns a DTS style timestamp with the TDF indicated. Takes arguments as the other operations. Requires r permission on the DTS entity.

    5. clock synchronize

       This is a synonym for the dts synchronize command. Takes arguments as the other operations. Returns an empty string on success. Requires w permission on the DTS entity.

    6. clock compare

       Used to compare the difference between the time on a specified machine and a time provider. The optional argument specifies the name of the host to compare time with. If not specified, _s(dts) is used. If that is not set, the local clock is checked. A random time provider is used to compare against the specified clock, any DTS entity may be specified to use via the optional -server option. Requires r permission on the DTS entity.

       The output format is as follows:

       dcecp> clock compare /.:/hosts/ice/dts-entity
       {server /.../dcecp_cell.osf.org/hosts/ninja/dts-entity}
       {provider yes}
       {skew -0-00:00:00.328I-----}
       

    aud

    The aud object represents the audit daemon (called auditd in the reference implementation) on a host. The daemon creates audit trails on a single host. The administrative functions are limited to changing the state of the daemon (enabled, disabled, stopped), and changing the strategy used to deal with running out of storage for the audit trails.

    If called with no argument, this command operates on the audit daemon on the local host, unless the _s(aud) convenience variable is set. If set, the value is taken to be the name of an audit daemon's server entry, as found in the DCE namespace, or as a string binding; and that audit daemon is contacted to service the requests. An argument can also be given to these commands whose value is the same as that of the _s(aud) convenience variable. The argument takes precedence over the convenience variable.

    The attributes are:

    1. stostrategy

       The audit trail storage strategy of the daemon. This attribute defines what the daemon will do if the audit trail storage is full. Its possible values are: save in which case the daemon will no longer service logging requests (the state attribute will be changed to disabled) or wrap where the daemon will overwrite the old audit trails.

    2. state

       Tells whether the audit daemon is accepting audit log requests or not. The values are enabled or disabled.

    Supports the following operations:

    1. aud disable

       Disables an audit daemon. The state attribute is changed to disabled. The control (c) permission on the audit daemon's ACL is required for this command. Returns an empty string on success.

    2. aud enable

       Enables an audit daemon. The state attribute is changed to enabled. The control (c) permission on the audit daemon's ACL is required for this command. Returns an empty string on success.

    3. aud help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. aud modify

       Allows modification of the attributes above. Accepts the -change option which takes an attribute list as a value. Also accepts the attribute options -stostrategy and -state. The control (c) permission on the audit daemon's ACL is required for this command. Returns an empty string on success.

    5. aud operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    6. aud rewind

       Rewinds a trail file to the beginning. The argument is the name of an audit daemon to operate on. By default the central trail file is rewound, the -trail option can be used to specify another trail file. Returns an empty string on success. The control (c) permission on the audit daemon's ACL is required for this command.

    7. aud show

       Returns an attribute list for the audit daemon. The attributes are returned in lexical order. The read (r) permission on the audit daemon's ACL is required for this command.

    8. aud stop

       Stops the audit daemon process. The control (c) permission on the audit daemon's ACL is required for this command. Returns an empty string on success.

    audfilter

    This object represents audit filters (a.k.a. event filters) which are kept by the audit daemon of each host to determine if an auditable event should be logged. An audit filter consists of a list of guides. The name of the audit filter is a filter type and possibly a key (dependent on the type).

    This command operates on the audit daemon on the local host, unless the _s(aud) convenience variable is set. If set, the value is taken to be the name of an audit daemon's server entry, as found in the DCE namespace, or as a string binding; and that audit daemon is contacted to service the requests.

    The audit filter types are as follows:

    1. principal -- key is a principal_name
    2. foreign_principal -- key is a /.../cellname/principal_name
    3. group -- key is a group_name
    4. foreign_group -- key is a /.../cellname/group_name
    5. cell -- key is a cell_name
    6. cell_overridable -- key is a cell_name
    7. world -- has no key
    8. world_overridable -- has no key

    So the following are examples of audit filter names: principal melman, group dce, world.

    A guide contains three elements: audit conditions, audit actions, and event classes. Each of these three elements is itself a list. Event classes are definable by the administrator. The possible audit conditions are: success, failure, denial, and all. The possible audit actions are: none, log, alarm, and all. If the all bit is returned from the API, then only all is displayed by the show operation. I.e., you will not see {log alarm all}.

    Supports the following operations:

    1. audfilter catalog

       Returns a list of names of all filters in the audit daemon. This command takes no arguments. The names are a list of a type and if necessary a key. They are returned in an arbitrary order. The read (r) permission on the audit daemon's ACL is required for this command. In the following example, there are four filters in the audit daemon:

       dcecp> audfilter catalog
       {principal melman}
       {foreign_principal /.../cell_X/kevins}
       {group dce}
       world
       

    2. audfilter create

       Creates a new audit filter. The argument is a list of names of audit filters to be created. Since a filter that has no guides will be removed by the audit daemon during a garbage collect phase, this command requires a -attribute option whose value is a list of guides to be added to the specified audit filters on creation. All guides are added to all audit filters specified to be created. Returns an empty string on success.

    3. audfilter delete

       Deletes the filter including all filter guides. The argument is a list of names of audit filters to be deleted. The write (w) permission on the audit daemon's ACL is required for this command. Returns an empty string on success.

    4. audfilter help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. audfilter modify

       This operation is used to add or remove one or more guides of a filter. The argument is a list of names of audit filters to be modified. In addition, the specific operation to perform is described with one or more of the following options: -add and -remove. The values of these is a list of guides. If more than one guide is specified then all guides are operated on, but not atomically. If the last guide is removed from a filter, the filter will be deleted at some point by the audit daemon. Returns an empty string on success. The write (w) permission on the audit daemon's ACL is required for this command. For example:

       dcecp> audfilter modify \e
       > {foreign_principal /.../cell_X/foo} \e
       > -remove {denial alarm IBM_Confidential_Restricted}
       dcecp> audfilter modify world -add {
       > denial log Monetary_Transfers}
       

       Atomicity of multiple actions is not guaranteed. The effect of removing a guide from a filter which does not have an identical guide is to change the existing guide(s). Similarly, the effect of adding a guide which partially exists in the specified filter is to change the existing guide(s). These changes guarantee that the semantics of the removal/addition is maintained.

    6. audfilter operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. audfilter show

       Returns a list of guides in a specified filter. The argument is a list of filter names (a filter type, and if needed a key) to be shown. If more than one is entered, the output is concatenated together with a blank line between filters. The read (r) permission on the audit daemon's ACL is required for this command. For example:

       dcecp> audfilter show {foreign_principal /.../cell_X/foo}
       {denial log IBM_Confidential}
       {denial log IBM_Confidential_Restricted}
       {denial alarm IBM_Confidential_Restricted}
       {denial all IBM_Confidential_Restricted}
       dcecp> audfilter show world
       {success log Monetary_Transfers}
       

    audevents

    This object represents the event classes that are recognized by an audit daemon on a host. Each event class is defined in an event class configuration file, and the file name is the symbolic name of the event class.

    This command operates on the audit daemon on the local host, unless the _s(aud) convenience variable is set. If set, the value is taken to be the name of an audit daemon's server entry, as found in the DCE namespace, or as a string binding; and that audit daemon is contacted to service the requests.

    Supports the following operations:

    1. audevents catalog

       Returns a list of the names of all event classes. This command takes no arguments. The order returned is arbitrary. The read (r) permission on the audit daemon's ACL is required for this command. For example:

       dcecp> audevents catalog
       EC_OSF_C2_Authentication
       EC_OSF_C2_Object_Deletion
       EC_OSF_C2_Security_State
       EC_OSF_C2_Controlled_Access
       EC_OSF_C2_Network_Exception
       EC_OSF_C2_Cryptographic
       EC_OSF_C2_Configuration
       

    2. audevents help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    3. audevents operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    4. audevents show

       Returns the contents of an event class. The argument is a list of names of event classes. Returned is a list of one name and several 32 bit integers displayed in hex. The name is the event class name, the rest are the numbers of the events that are in the event class. If more than one event class is given in the argument then several lists of this format will be output, concatenated together as one list with a blank line between event classes.

    In the future create and delete operations could be added to this object to allow for the creation of new event classes. These could be implemented as base Tcl scripts as all that is necessary is the manipulation of files.

    audtrail

    The audtrail objects represents an audit trail file. This object currently supports only one operation which converts the audit trial into a human readable format. Future extensions can add fancier conversion operations, or more likely new options. Supported operations are:

    1. audtrail help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    2. audtrail operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    3. audtrail show

       Returns the audit trail in a human readable format. This command takes as an argument a list of names of audit trial files. If more than one name is given then the output of each audit trail is concatenated together with a blank line between audit trails. Takes one option, -to to specify a single filename to put the trail in. If this option is not present, the trail is returned from the command. If the option is present the command returns an empty string. Read permission to the audit files is required for this operation.

    log

    The log object represents the current state of routing for DCE serviceability messages of a process. There are two types of routing supported, serviceability routing and debug routing. Debug routing may be removed from a production environment.

    The commands take one argument which is either a fully bound string binding or the name of a RPC server entry. See the Data Structures section for a description of the syntax of serviceability routing specifications and debug routing specifications.

    Supports the following operations:

    1. log help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    2. log list

       Returns a list of serviceability components registered by the server. Takes one argument which a list of either a fully bound string binding or the name of a RPC server entry (they can be mixed in the same list). If more than one is entered the output is concatenated together with a blank line between routings.

       Also takes an optional -comp option which is used to specify a list of component names. In this case, a list of sub-components is returned where each element of the list is a list of three elements: the subcomponent name, its level, and the text of the long description of the subcomponent. The order is arbitrary. If more than one is entered the output is concatenated together with a blank line between components.

       Example:

       dcecp> log list /.:/hosts/hostname/cds-server
       {svc cds dts rpc sec}
       dcecp> log list /.:/hosts/hostname/cds-server -comp dts
       {general  0  "General server administration"}
       {events   0  "Events received and acted upon"}
       {arith    0  "Math operations"}
       {ctlmsgs  0  "Control messages received"}
       {msgs     0  "Messages received"}
       {states   0  "Server state transitions"}
       {threads  0  "Thread interactions"}
       {config   0  "Server/cell configuration"}
       {sync     0  "Server sync interactions"}
       

    3. log modify

       Is used to change the routing specifications of the specified servers. Takes one argument which a list of either a fully bound string binding or the name of a RPC server entry (they can be mixed in the same list). Only the -change option is supported. There are a fixed well-known set of routing defaults. These can be changed, but new routings cannot be added or removed.\*(f! The

       The length of output on a show operation can change, but the semantics are add once then change. To avoid confusion in this case, only -change is supported.

       -change option takes a list of either serviceability or debug routing specifications. Returns an empty string on success.
    4. log operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    5. log show

       Returns a list describing the current serviceability routing settings for a server. If more than one is entered the output is concatenated together with a blank line between routings for different servers. The order of the returned routing settings is arbitrary. Takes an optional -debug option which indicates that debug routing settings are to be returned instead of normal serviceability routing settings.

    server

    The server object refers to servers running on a host. This one object can affect both the running daemons and the configuration information used by dced to start that daemon. The distinction is usually obvious by the definition of the operation or by the name given as an argument. When this is not the case, the ambiguity is resolved by a required option.

    Almost all of these commands contact the dced on the target host to perform their operations. Exceptions to this are noted below.

    The names given to server commands are all of the following form: /.../cell/hostshostname/config/service/name, where service is one of: srvrconf, srvrexec, or server. The first two umabiguously identifies the correct service as either the configuration service or the exectution service. The third is an ambiguous term but this can usually be resolved by context. For example, the stop operation only applies to a srvrexec object. In cases where it is still ambiguous, a srvrconf object is assumed unless the -executing option is present.

    Only the ERA's can be modified after creation, other attributes cannot. The attributes are:

    1. arguments

       The command line arguments passed to program on startup. Its value is a list of strings. May not be modified after creation.

    2. directory

       The working directory that the server is started with. May not be modified after creation.

    3. entryname

       The name of the RPC entry that the server exports binding information to.

    4. executing

       A list of two elements, the UUID of the server instance and the pid of the server. This attribute is only present if the server is running. This attribute is multi-valued, one value for each instance of the server.

    5. gid

       The POSIX gid that the server is started with. May not be modified after creation.

    6. keytabs

       A list of UUID's of related keytab objects where the server stores its keys. May not be modified after creation.

    7. operations

       A list of operation id's (integers) supported by the registered server. This attribute is accepted on input but not produced on output. It is implemented mostly for forward compatibility with future versions of dced.

    8. principals

       A list of principal names that the server runs as. For example secd runs as three different principals. A fully qualified name is always returned on output. On input a relative principal name represents a principal in default cell of the dced. May not be modified after creation.

    9. program

       The name of the server program to be run. Its value is a string. May not be modified after creation.

    10. prerequesites

        A list of UUID's of other server configuration objects that represents servers that must be running before this one is started. In DCE 1.1 this information is not used to start the other servers, it is just a note to the administrator. Future version of dced will probably take action based on this attribute. May not be modified after creation.

    11. services

        A list where each element is an attribute list of the following attributes:

        1. annotation

           A human readable PCS string describing the service.\*(f!

           This is not an i18n string for compatibility with DCE 1.0 endpoint map annotation strings.

        2. bindings

           A list of string bindings identifying the service. This is only specified for well-known endpoints.

        3. entryname

           The of an RPC entry where the service binding information is exports.

        4. flags

           The value is a list of key words to identify flags for the server. Currently only one is supported:

           1. disabled -- The mapping has been removed from the endpoint map.
        5. ifname

           A PCS name of the interface of the service.

        6. interface

           The interface identifier (UUID and version) of the service.

        7. objects

           A list of object UUID's supported by the service.

    12. starton

        This attribute identifies when a server should be started. The value is a list of one more more of the following:

        1. auto -- Start if an rpc that would be serviced by this server is received by dced. Ignored for those servers that are repositories.
        2. boot -- Start at system startup.
        3. explicit -- Start if dced receives a command to start the server (e.g., the server start command in dcecp).
        4. failure -- Start if dced detects that the server exited with a non-successful error code.
        5. schedule -- Reserved for future use, this value will be allowed to specify start this server at 6am Sunday morning.. The time would have to be specified via an ERA.

        May not be modified after creation. Specifying a null value to this attribute means the server will not be started. An example of a possible value is:

        {server {boot failure auto}}
        

    13. uid

        The POSIX uid that the server is started with. May not be modified after creation.

    14. uuid

        The internal identifier of the object. It can be specified on creation, or automatically generated, but once created it may not be modified.

    Server configuration objects may also have ERA's attached to them. They may be manipulated by the modify operation.

    Supports the following operations:

    1. server catalog

       Returns a list of the names of all server configuration objects on a specified host. If called with the optional -executing option, returns the name of all servers known by dced that are currently running on the specified host. If called with no arguments returns information about the local host. The optional argument is a list of hostnames. If more than one is specified then the information returned is concatenated together with a blank line between servers. The order of information returned is arbitrary. Fully qualified names are returned by default, the -simplename option can be used to remove the /.../cellname/hosts/hostname/config/service/ prepended on each name from the output.

    2. server create

       Creates a server configuration object. The argument is a list of names of server configuration objects to be created. A -attribute option with an argument list as a value is required to define attributes for the server to be created. Also accepts attribute options. Returns an empty string on success.

    3. server delete

       Deletes a server configuration object. The argument is a list of names of server configuration objects to be deleted. Returns an empty string on success. An error is returned if any of the objects do not exist.

    4. server disable

       Disables the specified server. Communicates with dced and removes the endpoints for all interfaces registered by the server (except the rpc_mgmt interface) from the endpoint map. The argument is a list of names of server execution objects. Accepts an optional -interface option to specify a list of interfaces to be disabled. Returns an empty string on success.

    5. server enable

       Enables the specified server. Communicates with dced and adds endpoint mapping for all interfaces registered by the server to the endpoint map. The argument is a list of names of server execution objects. Accepts an optional -interface option to specify a list of interfaces to be enabled. Returns an empty string on success.

    6. server help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    7. server modify

       Used to add or remove attributes and their values from the server object. The argument is a list of names of server objects to be modified. Accepts the -change option which must have an attribute list as its value. Attribute options are not supported for this command. The name is always for a server configuration object, you many not modify a server execution object.

    8. server operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    9. server ping

       Pings a server to see if it is receiving requests. This operation communicates directly with the server and not dced\*(f! The

       Excluding the normal endpoint resolution resulting from getting a partial binding from the namespace.

       argument is a list identifying the servers to ping. Returns a list of values, one for each server specified in the argument, in the same order. The values are 1 if the server is listening for RPC requests, 0 if not. Each argument can be in one of the following formats:
       1. The name of a server entry in the namespace to be imported from.
       2. A partially bound string binding with an object UUID specified.
       3. A fully bound string binding.
    10. server show

        Returns an attribute list of the server entries specified in the argument. The argument is a list of names of server object entries. If the names are ambiguous, server configuration objects are assumed unless the -executing option is present. If the argument is a list the output is concatenated together with a blank line between servers.

        dcecp> server show /.:/hosts/foster/config/try_tserver
        {uuid 003b24d2-a196-1df3-915f-0000c0ba4944}
        {program tserver}
        {arguments /.:/hosts/foster/test_server}
        {prerequisites {}}
        {keytabs {}}
        {entryname /.:/hosts/foster/test_server}
        {services
         {{ifname  {test server}}
          {annotation {dcecp server test program}}
          {interface {008bebed-c7c1-1ddc-9cb3-0000c0ba4944 1.0}}
          {bindings {ncadg_ip_udp 130.105.5.50}}
          {objects 0073f23a-2e1a-1ddd-b73a-0000c0ba4944}
          {flags {}}
          {entryname /.:/hosts/foster/test_server}}}
        {principals /.../foster_cell/tserver}
        {starton boot auto explicit failure}
        {uid 0}
        {gid 0}
        {dir /project/dce/build/nb_486/install/at386/dcetest/\e
        dce1.1/test/tet/functional/admin/dcecp/ts/server}
        

    11. server start

        Contacts a dced to start a server based on a server configuration object. The argument is a list of names of server configuration objects. Returns the UUID of the started server on success. This is the UUID found in the serverexec object for the server.

    12. server stop

        Stops the specified running server processes. The argument is a list of names of servers. Returns an empty string on success. Takes an optional -method option to specify how dced should stop the server. The values of this option must be one of the following:

        1. rpc -- Have dced use rpc_mgmt_server_stop_listening. This is the default.
        2. soft -- Use a soft local mechanism (e.g., SIGTERM).
        3. hard -- Use a hard local mechanism (e.g., SIGKILL).
        4. error -- Use a state-preserving mechanism (e.g., SIGABRT).

    hostdata

    The hostdata object represents a hostdata entry stored by dced on a host that represents some data, usually a file. The data itself is represented by the data attribute of the entry. Remote manipulation of this data is accomplished by these commands. The names of these hostdata objects are in the DCE namespace and are served by dced's. They are of the form: /.:/hosts/hostname/config/hostdata/name. The attributes are:

    1. uuid

       An internal identifier for the hostdata entry. Its value is a UUID. If not specified on creation, one is generated by dcecp. May not be modified after creation.

    2. annotation

       A human readable comment field limited to PCS data. May not be modified after creation.

    3. storage

       This is a PCS string that identifies the name of the data repository. In the first release of dced, it is a filename. It may not be modified after creation.

    4. data

       An attribute that represents the actual data. Its syntax is a list of strings. In the common case, each string represents one line in the hostdata file. The data can viewed and modified in two different modes, either as a string, or as binary data.\*(f! By

       This is similar to the ASCII and BINARY modes in ftp. It's still the same data, it can just be seen in two different ways.

       default the string mode is used, but some of the commands below accept a binary option to allow this attribute to be displayed or modified in binary form.

    Supports the following operations:

    1. hostdata catalog

       Returns a list of the names of all objects on the specified host in arbitrary order. The argument is a list of hostnames. If more than one is specified the output is concatenated together with a blank line between hostdata objects. If no argument is given the local host is assumed. Fully qualified names are returned by default, the -simplename option can be used to remove the /.../cellname/hosts/hostname/config/hostdata/ prepended on each name from the output.

    2. hostdata create

       Creates a hostdata configuration object. The argument is a list of names of hostdata entries to be created. Takes a -attributes option to specify configuration information for dced. Also accepts attibute options. A -binary option can be specified which indicates that the value of the data attribute is specified in binary form. Returns an empty string on success.

    3. hostdata delete

       Deletes a hostdata entry and its data. The arugment is a list of names of hostdata entries to be deleted in the order specified. If the -entry option is present, only the configuration information that dced keeps is deleted, not the actual hostdata. Returns an empty string on success.

    4. hostdata help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. hostdata modify

       This operation is used to change attributes of a hostdata entry, including the hostdata itself. The argument is a list of names of hostdata entries to be modified. If more than one is specified all modifications specified are done to each hostdata entry listed. In the first release only the data attribute is modifiable, and it can only be completely replaced. Accepts a -change option to specify an attribute list of new values. Also accepts attribute options (just -data in DCE 1.1). A -binary option can be specified which indicates that the value of the data attribute is specified in binary form.

    6. hostdata operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. hostdata show

       Returns an attribute list of the hostdata entries specified in the argument. The argument is a list of names of hostdata entries. If called with the -entry option, then the data attribute is not returned. A -binary option can be specified which indicates that the value of the data attribute should be returned in binary form. If the argument is a list the output is concatenated together with a blank line between hostdata objects.

    keytab

    The keytab object represents key tables (limited to files in DCE 1.1) that store server keys (and key version numbers) on hosts. These keytab's are manipulated remotely via dced and as such there is configuration information that dced maintains about each keytab. This information is represented as the attributes on this object. The keys are considered members of the keytab container.

    The names of keytab's are similar to other dced objects, namely: /.../cell/hosts/hostname/config/keytab/name.

    A key table has a set of keys. Each key contains a fully qualified principal name, type, version, and value. The value can be created and changed, but is normally not shown on output (see -keys on endpoint show below). Removal of a key is based on the name, type and version number. The Tcl syntax of a key is a list of principal name, type (which is either plain or des), version (a non-negative integer), and value. The value of a des key is 64 bits long and can be represented as ERA's of type byte are. See the xattrschema object for details. The value is valid on input but are not normally displayed so that keys are not shown on the screen. For example:

    melman des 1 key1
    melman plain 3 key2
    

    Multiple keys for the same principal are displayed as separate keys. See the example in the keytab show command below.

    The following are the attributes of a keytab object:

    1. uuid

       The internal identifier of the configuration information kept by dced for this keytab. This is generated automatically by the system if not entered. May not be modified after creation.

    2. annotation

       A human readable comment string limited to PCS. May not be modified after creation.

    3. storage

       The name of the key table (usually a filename). May not be modified after creation.

    4. data

       The contents of the key table. Represented as a list of keys.

    Local key tables can also be manipulated without using dced. This is useful in some error recovery situations (e.g., fixing the host keytab when the disk it's on crashes), it is a special dced bypass operation, not a normal keytab operation. All of the following keytab operations take a -local option. When used in this manner dcecp keeps track of the keytab objects that are created on a per session basis. That is, local keytab files are manipulated, but objects representing them that contain all the attributes described above are stubbed by dcecp. These stubbed keytab objects have names and attributes just as regular keytab objects do. There is no way for dcecp to know what local key table files exist at startup (they can be anywhere in the file system), so knowledge of them is lost when you exit dcecp.

    Key tables store server keys which is sensitive information. It would be a security hole for unauthorized users to obtain this information. As such, the RPC calls used for these operations uses RPC Privacy (i.e., DES encryption) for all the data by default. This is not always possible (e.g., due to encryption export and use laws in various countries). All of the following commands accept a -noprivacy option to use the default protection level instead. This option will probably be deprecated in future releases in favor of a more general mechanism that allows control of all binding handles used by dcecp. See the Changes for Future Versions section for a description of the _a convenience variable.

    Supports the following operations:

    1. keytab add

       This command is used to add a members to a keytab. The argument is a list of names of keytabs to have members added to. The value of the required -member option is a list of principal names to be added to each keytab in the argument. The principals must exist or the command will return an error. The principal is added to the key table along with a key. Use either -random to have dced generate a random des key, or -key with a value to specify a plain key explicitly. The same key (whether specified or randomly generated) is used for all principals being added to all key tables. The -registry option will update the principal's key in the registry as well, it is required if -random is used. Returns an empty string on success. For example:

       dcecp> keytab add /.:/hosts/foo/config/keytab/bar \e
       -member melman -random -registry
       dcecp> keytab add /.:/hosts/foo/config/keytab/bar \e
       -member melman -key keyvalue
       

       You must specify either -registry or -version or both on any keytab add command.

    2. keytab catalog

       Returns a list of the names of all keytab's on the host specified in the argument. If a host name is not specified then the current host is used. If the argument is a list then the output is concatenated together with a blank line between keytabs. The return order is arbitrary. Fully qualified names are returned by default, the -simplename option can be used to remove the /.../cellname/hosts/hostname/config/keytab/ prepended on each name from the output.

    3. keytab create

       Creates a key table. The argument is a list of names of keytab's to be created. Takes a -attributes option to specify configuration information for dced. Also accepts attribute options. The contents of the keytab can be specified via the data attribute. The value of the option is applied to all elements of the argument list. Returns an empty string on success.

       The value of the data attribute, if specified, is a list of keys. Each key must have a principal name and key type. The version is optional, if not present, the system will generate a version of 1. If the key type is plain a key value must be specified, if the type is des then it may be specified, but if not present, one will be randomly generated only if the -random option is present.

       For example:

       dcecp> keytab create /.:/hosts/foo/config/keytab/bar \e
       -attr {
       > {storage /opt/dcelocal/keys/bar}
       > {data {melman des}
       >       {melman plain 3 key2}
       >       {pwang des 2 key3}}}
       

    4. keytab delete

       Deletes a key table entry and its keys. The argument is a list of names of keytab's to be deleted in the order specified. If the -entry option is present, only the configuration information that dced keeps is deleted, not the actual key table. Returns an empty string on success.

    5. keytab help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    6. keytab list

       Returns a list of all the principals in the specified key table. If the argument is a list of keytab's the output is concatenated together with a blank line between keytabs.

    7. keytab operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    8. keytab remove

       This command is used to remove a member from a keytab. The argument is a list of names of keytab's to have members removed from. The value of the required -member option is a list of names of principals which will be removed from the keytab's listed in the argument. The two options -version and -type can be used to limit the keys removed. If either or both of these options is present, then only keys matching the values of these options are removed. The value of the -version option can be a list of version numbers. Returns an empty string on success. For example:

       keytab remove keytabname -member melman -type des
       

       removes all des keys for principal melman.

    9. keytab show

       Returns an attribute list of the keytab's specified in the argument. The argument is a list of names of keytab's. If called with -entry then the data attribute is not returned. If the optional -members option is given then only the value of the data attribute is returned (a list of keys). Keys are not normally output unless the -keys option is used. If the argument is a list the output is concatenated together with a blank line between keytabs. For example:

       dcecp> keytab show /.:/hosts/foo/config/keytab/bar \e
       -members
       {melman des 1}
       {melman plain 3}
       {pwang des 2}
       

    secval

    The secval object represents the security validation service running on a host, usually as part of the dced server. This service is responsible for maintaining the security credentials of the host machine\*(f!

    There are two reasons to make this a separate object aside from the server object with the interface UUID of the security validation service:

    1. The server disable command really just removes the endpoint from the endpoint map, the server continues to run, it just won't be routed new requests from new clients (i.e., existing binding handles and clients knowing the endpoint would still work). For secval you are really turning off the service.
    2. Since secval is implemented in dced it registers its endpoints specially in the endpoint map. Normal server disable and server enable commands will not work for dced implemented services.

    and is also involved in authenticating local DCE logins and updating the hosts' idea of the cell names. These commands take as an argument a list of names of hosts to operate on.
    1. secval activate

       Activates a security validation service. If it is not deactivated an error is returned. Returns an empty string on success.

    2. secval deactivate

       Deactivates a security validation service. If it is not activated an error is returned. Returns an empty string on success.

    3. secval help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. secval operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    5. secval ping

       Validates the credentials returned by a DCE security service. This is expected to be a rarely invoked routine, but could be used to verify that secd is trusted. Returns 1 if the credentials are valid and 0 if not. If the argument is a list then a list is returned, with an integer for each server.

    6. secval status

       Returns a 1 if the secval service is activated, 0 if not. If the argument is a list then a list is returned, with an integer for each server.

    uuid

    The uuid object refers to UUID's. Only two operations are supported:

    1. uuid create

       Returns a newly generated UUID. Takes no arguments.

    2. uuid compare

       Compares two UUIDs. Returns 1 if they are equal, 0 if not. This is not just string compare since there are some old string formats of UUID's that are supported.

    3. uuid help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. uuid operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    name

    The name object refers to DCE names.

    1. name compare

       Compares two names given as arguments and returns 1 if they both syntactically refer to the same name. Otherwise returns 0.

    2. name expand

       Takes a single name as an argument and returns the canonical form of the name. This has the affect of converting /.: to /.../cellname.

    3. name get

       Given a single string binding as an argument, returns the fully qualified global name of the host referred to by that binding.

    4. name help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. name operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    6. name parse

       Parses a name into a cellname and a residual name. The argument is a single DCE name. Returns a list of two elements: cellname and residual name. A name not begining with a / is considered to be a name in the local cell.

    utc

    The utc object represent UTC timestamps and allows manipulation (math and comparison) of them.

    1. utc add

       Returns the sum of two timestamps. The timestamps can be two relative times or a relative time and an absolute time.

    2. utc compare

       Takes two timestamps and returns -1 if the first is earlier, 1 if the second is earlier, and 0 if it is indeterminate. Accepts a -noinaccuracy to ignore inaccuracies in comparisons, in this case a return 0 of zero indicates the times are the same.

    3. utc convert

       Given a timestamp, returns another timestamp expressing the same time in the local timezone. If called with -gmt returns GMT formatted timestamp. <

    4. utc help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    5. utc multiply

       Accepts two arguments a relative timestamp and an integer or floating point factor and returns former multiplied by the later.

    6. utc operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. utc subtract

       Returns the difference between two timestamps that express either an absolute time and a relative time, two relative times, or two absolute times.

    attrlist

    The attrlist object represents an attribute as returned or accepted by many dcecp command. This object can be use to check or manipulate attribute lists so that they can be used by other commands, most commonly in scripts. The getvalues operation will probably be used commonly in interactive sessions, when users want to see the value of one only attribute, since the show commands return all attributes.

    The arguement to all of these commands is a single attribute list. Supports the following operations:

    1. attrlist add

       Returns an attribute list with the attributes specified as the value of the required -member option appended. For example:

       dcecp> attrlist add {{a b} {c d}} -member {{e f} {g h}}
       {a b} {c d} {e f} {g h}
       

    2. attrlist getvalues

       Returns the values of all attributes of a type specified by the value of the required -type option. The value may only be a single type, but the if the attribute appears more than once in the attribute list, the value of each instance is returned on a separate line though the length of the returned list matches the number of individual values found. For example:

       dcecp> attrlist getvalues {{a w x} {c y} {a z} -type a
       w x
       z
       

       This command is expected to be use as commonly as grep to view the output of show commands. For example:

       dcecp> attrlist get [dir show /.:/hosts] -type CDS_UTS
       1994-07-01-10:29:59.265-05:00I0.000/00-00-c0-f7-de-56
       

       With abbreviations this could be entered as:

       dcecp> at g [dir show /.:/hosts] -t CDS_UTS
       1994-07-01-10:29:59.265-05:00I0.000/00-00-c0-f7-de-56
       

    3. attrlist help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. attrlist list

       Returns a list of all the attribute type names in the attribute list in the order that they appear in the list. For example:

       dcecp> attrlist list {{a b} {c d}}
       a b
       

    5. attrlist modify

       Returns an attribute list with attributes modified as specified by the -add, -remove and -change options. New attributes can be added, or new values added to existing attributes with -add. Entire attributes or attribute values can be removed with -remove. The -change option will remove all values from an existing attribute and replace them with new values specified.

    6. attrlist operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    7. attrlist remove

       Returns an attribute list with the attribute types specified as the value of the required -member option removed. For example:

       dcecp> attrlist remove {{a b} {c d} {e f}} -member {c e}
       {a b}
       

       This command only removes entire attributes, to remove specific values, use the modify command.

    cdsalias

    The cdsalias object represents cell names as known by CDS. This object lets you manipulate alias and primary names of DCE cells. Each cell has one primary name. This is the name returned by the cell. Cells may also have alias names. Currently this object only affects the CDS component. The security server and each host must also be informed of any new cell aliases.

    This object can also be used to define a hierarchical relation between been one cell and another amongst the CDS' of the two cells. When defining a hierarchical relationship, a trust relationship also needs to be established. Use the account object to do this.

    Supports the following operations:

    1. cdsalias catalog

       Returns a list of all defined cell aliases. The first element is the primary name of the cell. Requires read permission on the root directory of the cell. This command takes an optional argument specifying the name of a cell to contact, the argument defaults to /.:.

    2. cdsalias connect

       Establishes a hierarchical relationship between two cells. It takes no argument. The current primary name of the cell is used, the last RDN is removed to identify the parent cell. Requires administer permission on the root directory of the child cell and insert permission on the root directory of the parent directory.

    3. cdsalias create

       Creates a new alias cellname for the local cell. The required argument is a single fully qualified alias name of the cell. If the alias name already exists an error is returned. Returns an empty string on success. Requires administer permission on the root directory of the cell.

    4. cdsalias delete

       Deletes an existing alias cellname. The required argument a single fully qualified alias name of the cell. If the alias name does not exist an error is returned. It is an error to attempt to delete the primary cell name. Returns an empty string on success. Requires administer permission on the root directory of the cell.

    5. cdsalias set

       If called with no options, sets the primary name of the cell to the alias named in the argument. The required argument is a single fully qualified name of an existing cell alias. This command should only be used if the CDS and Security servers as well as each host in the cell know about the cell alias. Requires administer permission on the root directory of the cell. Returns an empty string on success.

    Miscellaneous commands

    1. dcecp_initInterp

       This command will initialize a base Tcl interpreter with all the dcecp commands.

    2. errtext

       Takes a DCE status code as an argument and returns the text of the associated message as found in the message catalogs. The argument can be in decimal, octal (leading 0), or hexadecimal (leading 0x) notation.

    3. login

       Creates a new login context to be used for the rest of the dcecp session. Login contexts are stacked. Takes an account name as an argument. The password is prompted for and not echoed to the screen. Accepts a -password option to enter a password. Also accepts a -certify option to perform a certified login. The _u and _c convenience variables are updated after a successful login.

    4. logout

       Logs you out of the current login context as established with a previous login command. Only contexts created with dcecp's login can be logged out of. Trying to logout of an inherited context results in an error. Leaving dcecp will do a logout for all contexts created in the session.

    5. quit

       Exits from dcecp. A synonym of the Tcl builtin command exit.

    6. resolve

       Takes a partial string binding and returns a fully bound string binding. Takes a -interface option with an interface identifier as an argument to provide enough information for the mapping to occur. Takes an optional -object option whose value is a single UUID to specify resolution further.

    7. shell

       Spawns a command shell for the user. The value of the SHELL environment variable is used to obtain the name of the shell to spawn. When the command shell terminates, control is returned to dcecp. If called with arguments, they are passed to the shell and executed. Control is returned upon completion. Always returns an emptry string, though an error exception is generated if the shell exists abnormally.

    Tasks

    The following are administrator tasks to be implemented as dcecp scripts. To the user, they will appear exactly like commands.

    user

    The user object represents all of the data associated with a DCE user. This includes registry information and a CDS directory in the default implementation. The user object is meant as a high level abstraction to allow administrators to easily create, delete and view user information.

    The user object comprises a principal and account in the registry; registers the principal in a group and an organization, creating them if necessary; and a CDS directory named after the principal with the appropriate ACL. Only the principal and account attributes are considered attributes of the user object, and are the only ones displayed by the show operation.

    A principal name is used as the name of user objects. The naming conventions for principal names apply; if no cellname is given it is assumed to be in the current cell. If one is specified, the other cell is contacted.

    This object is implemented as a script to allow it to be manipulated and extended on a per-site basis. For example, administrators might want to add GDS and DFS information to the object. Other possible modifications include:

    1. Changing the location of the CDS directory created for users, or remove it completely.
    2. Changing the default ACL's placed on the various objects.
    3. Setting certain attributes or policies on all newly created principals and accounts to match the site's policies.
    4. Setting up site specific defaults for passwords (to be changed by the user later), groups, organizations, principal directories, etc.
    5. Supporting a user modify command.

    Supports the following operations:

    1. user create

       Creates a single DCE user. The argument is a list of names of new principals to be added to the registry. Returns an empty string on success. On error attempts to cleanup any interim operations that have completed.

       This commands creates a principal and an account for that principal. If either previously exist an error is generated. The principal is then added to the specified group and organization. Since the principal is created, it can't have been a member of either. If the group or organization does not exist an error is generated unless the -force option is used. Creates a CDS directory called /.:/users/principalname and add an ACL entry to the default ACL so that the user has rwtci permissions on the directory. This allows all access except for deleting the directory and administering replication on the directory.

       Attributes and policies for the newly created principal and account may be specified with the -attributes option and specifying an attribute list as the value, or with attribute options. This command will attempt to add any unknown attributes as ERA's on the created principal object. Policies of the organization may not be specifed as these would probably affect more than just the created user. The required group and organization names may be specified either as attributes in the -attributes option, or via the -group and -organization options. The required password attribute may be provided as in the account create command, and the -mypwd option is also required.

    2. user delete

       Deletes a DCE user. Deletes the principal from the registry which also deletes the account and removes the principal from any groups and organizations. Deletes the /.:/users/principalname directory and any contents. The argument is a list of the principal names of DCE users. Returns an empty string on success.

    3. user help

       Returns help information on the object as described in the Help System section. Takes an argument which may be an operation supported by the object or the -verbose option to return more information.

    4. user operations

       Returns a list of the operations supported by the object. It takes no arguments, and always returns a Tcl list suitable for use in a foreach statement. The order of the elements is alphabetical with the exception that help and operations are listed last.

    5. user show

       Returns the attributes of a DCE user. This includes principal attributes and ERA's, and account attributes and policies. The argument is a list of dce principal names, if more than one is given the output is concatenated together with a blank line between users. The information is returned as if the following commands were run in the following order:

       principal show
       account show -all
       

    host

    The host object represents a machine in (or to be added to) a DCE cell. Currently it represents DCE processes running on a host, but this could be expanded in the future to address static data as well. The host object is meant as a high level abstraction to allow administrators to easily configure and start DCE on machines.

    The host object can configure and start the core DCE services on a machine. This includes dced, CDS, and dtsd. The argument to this command is the DCE name of a host to operate on. If an argument is not given, then the local host is assumed. If called in this manner then the behavior of the command may be slightly different so that more is done on the local host then is possible remotely. Details are described below in each operation.

    This object is implemented as a script to allow it to be manipulated and extended on a per-site basis. For example, administrators might want to add GDS and DFS information to the object. Other possible modifications include:

    1. Adding calls to specialized commands to start or stop application servers. Something like: "printer stop".

    Supports the following operations:

    1. host catalog

       Returns a list of names of hosts in the cell. The names are fully qualified unless the -simplename option is used in which case they are cell relative. The optional argument can specify a cell to operate in. For example:

       dcecp> host catalog
       /.../cell_foo/hosts/alpha
       /.../cell_foo/hosts/beta
       /.../cell_foo/hosts/gamma
       dcecp> host catalog -simplename
       hosts/alpha
       hosts/beta
       hosts/gamma
       

    2. host configure

       Configures a single machine named by the argument into a DCE cell. The cell must already exist, having a security and naming service operating. The DCE software must already be installed on the machine. Operates via two mutually exclusive options:

       1. host configure -client

          Configures the local host as a DCE client machine. The required argument is the fully qualified DCE name of the host (e.g., /.:/hosts/hostname). Also required are the -secmaster and -cds options to specify the hostname of the security master server and the hostname of any CDS server respectively. Configures the machine to run dced (including the secval service), a DTS clerk, cdsadv, and auditd all via dced's server configuration service. Returns an empty string on success.

       2. host configure -server

          Configures the local host as a DCE server machine. It cannot configure a machine as the initial security or cds server in a cell. The required argument is the fully qualified DCE name of the host. If this machine is not already configured into a cell then the equivalent of a host configure -client is performed (with the options required by that command required by this command). All configurations are perfromed via dced's server configuration service.

          The command requires one or more of the following options: -security, -cds, or -dts to specify which servers to start on the host. The first two take no values. The -dts option takes a value of either local or global to specify what type of server to configure the DTS daemon as. If -dts is specified, the command optionally takes a -courierrole option which takes the values as per the corresponding attribute on the dts object.

    3. host ping

       This command will test if DCE processes are accesible from the network. It contacts the endpoint mapper (either rpcd or dced, whatever listens on port 135) on the specified host. The argument is the name or string binding of a single host to ping. Returns 1 if the host responds, 0 if not.

    4. host start

       Start all DCE processes on the specified host. This command depends on dced being running on the specified host, i.e., it may not be used to start DCE on a pre-1.1 machine. The processes that are started are all those listed in the server configuration data stored in the dced on the specified host with the boot or explicit values of the starton attribute.

       The argument is the name of host to operate on. If called with no argument then dced is started on the local host first which requires the appropriate local permissions (usually root). Minimally starts dced, cdsadv, dtsd, and auditd.

    5. host stop

       Stops running DCE processes on the specified host. This command depends on dced being running on the specified host, i.e., it may not be used to stop DCE on a pre-1.1 machine. The argument is the name of host to operate on. The processes that are stopped are as follows in the following order:

       1. All listed in the server execution data stored in the dced on the specified host.
       2. The following commands are then run with an argument if necessary specifying the appropriate host:

          dts stop
          aud stop
          registry stop
          

       3. If called with no argument then dced is stopped after all other processes. This might require the appropriate local permissions (usually root) or could be performed via dced if it stubs a server execution object for itself.

       Takes the '-force' option to stop any remianing processes with a server stop -method hard command.

    6. host show

       Returns a list describing all processes that are configured to run on the specified host. The optional argument is the fully qualified DCE name of a host. If not given, the local host is assumed. The returned list is of the form:

       1. Server name as output by server catalog -simplename.
       2. One of the tokens: running or notrunning.
       3. An optional server specific comment such as master or replica for a security server and clerk or server for a DTS server.
    7. host unconfigure

       Unconfigures a specified host from a cell. Deletes all objects, directories and links from /.:/hosts/hostname including the directory itself. Deletes all principal names begining with hosts/hostname/, this will automatically remove all accounts of the same names. Removes all local configuration files, and stops all running DCE processes (dced last). Takes the fully qualified name of a host to unconfigure as an argument. This command may not be run from the host to be unconfigured.

    cell

    The cell object represents a single DCE cell as a whole. This includes all machines, services, resources, principals, etc. In the initial release the operations on an entire cell will be limited, future expansion could include:

    1. cell create

       Creates a new cell, the equivalent of dce_config's Initial Cell Configuration menu.

    The argument to all of these command is a single cellname (not a list of cellnames). If omitted, /.: is the default. Supports the following operations:

    1. cell show

       Returns attributes describing the configuration of the specified cell. The returned attributes are:

       1. secservers -- each value is a the name of a security server.
       2. cdsservers -- each value is the name of a machine running a CDS server. The name is the simple name found under /.:/hosts.
       3. dtsservers -- each value is the name of a dts server in the cell.
       4. hosts -- each value is the name of a host in the cell, including machines mentioned above as servers. This is really dir list /.:/hosts -simplename.

       The names returned are fully qualified, unless the -simplename option is used:

       dcecp> cell show
       {secservers
        /.../dcecp_cell.osf.org/subsys/dce/sec/master
        /.../dcecp_cell.osf.org/subsys/dce/sec/ice}
       {cdsservers
        /.../dcecp_cell.osf.org/hosts/frick}
       {dtsservers
        /.../dcecp_cell.osf.org/hosts/frick
        /.../dcecp_cell.osf.org/hosts/ice
        /.../dcecp_cell.osf.org/hosts/ninja}
       {hosts
        /.../dcecp_cell.osf.org/hosts/frick
        /.../dcecp_cell.osf.org/hosts/ice
        /.../dcecp_cell.osf.org/hosts/ninja}
       dcecp> cell show -simple
       {secservers
        subsys/dce/sec/master
        subsys/dce/sec/ice}
       {cdsservers
        hosts/frick}
       {dtsservers
        hosts/frick
        hosts/ice
        hosts/ninja}
       {hosts
        hosts/frick
        hosts/ice
        hosts/ninja}
       

    2. cell ping

       Used as quick check to see if a cell is running. Can function in three different ways:

       1. If called with no option it pings (using server ping) the master security server, all CDS servers,\*(f!

          We had thought of only pinging those servers that have clearinghouses with master replicas, but there is no way to determine which clearinghouses are masters without contacting each clearinghouse and without possible looking at each directory in the cell.

          and all the DTS servers in the cell. In case of failure it generates an error and returns a list of servers that could not be contacted. In case of success it returns DCE services available.
       2. The -replicas option will cause the command to ping each security and CDS replica as well as those mentioned above. In case of failure it generates an error and returns a list of servers that could not be contacted. In case of success it returns DCE servers available.
       3. The -clients option will cause the command to ping every machine in the cell. It does this by looping though /.:/hosts and doing a host ping on the hostname. In case of failure it generates an error and returns a list of hosts that could not be contacted. In case of success it returns DCE clients available.
    3. cell backup

       Backs up the master security database and each clearinghouse with master replicas in the cell. Depends on there being a dced running on each of the server hosts. Takes no arguments or options.

    cellalias

    The cellalias object represents alias names of the cell. Unlike the cdsalias object it's scope is for all DCE core components and not just CDS. It can be used to define a new alias for the cell and for informing the security service, the CDS service, and each host about the new alias name, in that order. It can also be used to set a new primary name for the cell informing each involved service in order. Supports the following operations:

    1. cellalias create

       Creates a new alias cellname for the local cell. The required argument is a single fully qualified alias name of the cell. If the alias name already exists an error is returned.

       This command first informs the security service of the new name and sees that all security servers replicate the update, then it informs cds via the cdsalias create command, then each host in the cell via dced's hostdata command. Returns an empty string on success. On failure it returns a list of names (registry names, clearinghouse? names, and hostnames) that could not be contacted. This command tries to complete each of the three phases but will fail at the end of a phase.

       NOTE:
       permissions required? At least administer permission on the root directory of the cell. Sec? Hostdata?

    2. cellalias set

       Sets the primary name of the cell to the alias named in the required argument. The required argument is a single fully qualified name of an existing cell alias. This command should only be used if the CDS and Security servers as well as each host in the cell know about the cell alias (cellalias create will do this). Returns an empty string on success. Errors are handled the same as the cellalias create command.

       NOTE:
       permissions required? At least administer permission on the root directory of the cell. Sec? Hostdata?

       Command-line Editing Commands

       A line may be edited before it is sent to the dcecp by typing control characters or escape sequences. A control character, shown as a C- followed by a letter, is typed by holding down the control key while the letter is typed. For example, C-A is a control-A. An escape sequence is entered by typing the escape key followed by one or more characters. The escape key is abbreviated as ESC. Note that unlike control keys, case matters in escape sequences; ESC F is not the same as ESC f.

       An editing command may be typed anywhere on the line, not just at the beginning. In addition, a return may also be typed anywhere on the line, not just at the end.

       Most editing commands may be given a repeat count, n, where n is a number. To enter a repeat count, type the escape key, the number, and then the command to execute. For example, ESC 4 C-f moves forward four characters. If a command may be given a repeat count then the text [n] is given at the end of its description.

       The following control characters are accepted:

       1. C-A Move to the beginning of the line
       2. C-B Move left (backwards) [n]
       3. C-D Delete character [n]
       4. C-E Move to end of line
       5. C-F Move right (forwards) [n]
       6. C-G Ring the bell
       7. C-H Delete character before cursor (backspace key) [n]
       8. C-I Complete filename (tab key); see below
       9. C-J Done with line (return key)
       10. C-K Kill to end of line (or column [n])
       11. C-L Redisplay line
       12. C-M Done with line (alternate return key)
       13. C-N Get next line from history [n]
       14. C-P Get previous line from history [n]
       15. C-R Search backward (forward if [n]) through history for \& text; must start line if text begins with an uparrow
       16. C-T Transpose characters
       17. C-V Insert next character, even if it is an edit command
       18. C-W Wipe to the mark
       19. C-XC-X Exchange current location and mark
       20. C-Y Yank back last killed text
       21. C-[ Start an escape sequence (escape key)
       22. C-]c Move forward to next character c
       23. C-? Delete character before cursor (delete key) [n]

       The following escape sequences are provided.

       1. ESC C-H Delete previous word (backspace key) [n]
       2. ESC DEL Delete previous word (delete key) [n]
       3. ESC SPC Set the mark (space key); see C-XC-X and C-Y above
       4. ESC \. Get the last (or [n]'th) word from previous line
       5. ESC \? Show possible completions; see below
       6. ESC < Move to start of history
       7. ESC > Move to end of history
       8. ESC b Move backward a word [n]
       9. ESC d Delete word under cursor [n]
       10. ESC f Move forward a word [n]
       11. ESC l Make word lowercase [n]
       12. ESC u Make word uppercase [n]
       13. ESC y Yank back last killed text
       14. ESC w Make area up to mark yankable
       15. ESC nn Set repeat count to the number nn

       There is filename completion. Suppose the root directory has the following files in it:

       bin	vmunix
       core	vmunix.old
       

       If you type rm /v and then the tab key, as much of the name as possible will be finished off by adding munix. Because the name is not unique, it will then beep. If you type the escape key and a question mark, it will display the two choices. If you then type a period and a tab, the filename will be finished for you:

       rm /v[TAB]munix.[TAB]old
       

       The tab key is shown by [TAB] and the automatically entered text is shown in italics.

       API'S

       All commands in dcecp will be implemented as Tcl commands. Therefore, they are user-visible and can be used in dcecp scripts to implement new commands. Some commands are implemented in C since they make DCE library calls; they are also visible to users. However, often there will be another command written in Tcl that will wrap the C command to present a better interface to the user. In this case both commands are available to the user, but only the higher-level command will be documented.

       The lower-level commands can be found in the Tcl source, and can be considered in some sense to be dcecp API's. They will not typically be called directly by users, but will be visible to the Tcl-knowledgeable (i.e., they will be listed if an info commands is performed).

       For example, there will be one create command implemented in Tcl, it will read its first argument to determine the type of object being created (e.g., a group, a principal, a directory, etc.); it will then call another routine (usually implemented in C) for the lower-level functionality. This lower-level routine will be named the same as the upper-level command with an underscore and the type of object appended to it (e.g., create_group, create_principal, create_directory, etc.).

       REMOTE INTERFACES

       Not applicable.

       MANAGEMENT INTERFACES

       Not applicable.

       RESTRICTIONS AND LIMITATIONS

       Not applicable.

       OTHER COMPONENT DEPENDENCIES

       The dcecp will be dependent on the following DCE components:

       1. The NSI.
       2. The CDSPI.
       3. The sec_rgy interfaces.
       4. The sec_id interfaces.
       5. The sec_acl interfaces.
       6. The sec_login interfaces.
       7. The DTS interfaces.
       8. The Serviceability interfaces.
       9. The dced interfaces.
       10. The Auditing interfaces.
       11. The editline functionality from libdceutils.a.
       12. The sec_rgy_attr interfaces and when written the sec_attr interfaces.

       COMPATIBILITY

       The existing control programs will still be released, dcecp will be released in addition to them. As this is the first release of dcecp there is nothing for it to be compatible with. It makes use of DCE API's, so as long as they remain compatible with older versions of DCE servers, dcecp should be able to contact pre-1.1 DCE services.

       STANDARDS

       Not applicable except in that the dcecp code will follow the DCE Coding Style Guide [RFC 34].

       OPEN ISSUES

       None.

       MAPPING OF EXISTING CONTROL PROGRAM COMMANDS

       In the mappings lists of this Appendix, the commands in the left column map to the commands in the right column, unless specified otherwise.

       rpccp

       These are commands that are mapped directly:

       1. add element rpcprofile add
       2. add entry rpcentry create
       3. add member rpcgroup add
       4. export rpcentry export
       5. import rpc-{entry,group,profile} \e \& import
       6. remove element rpcprofile remove
       7. remove entry rpcentry delete
       8. remove group rpcgroup delete
       9. remove mapping endpoint delete
       10. remove member rpcgroup remove
       11. remove profile rpcprofile delete
       12. show entry rpcentry show
       13. show group rpcgroup list
       14. show mapping endpoint show -all
       15. show profile rpcprofile show
       16. show server rpcentry show
       17. unexport rpcentry unexport

       cdscp

       These are commands that are mapped directly:

       1. add directory directory modify
       2. add object object modify
       3. clear cached server cdscache delete
       4. clear clearinghouse clearinghouse disable
       5. create child directory add
       6. create clearinghouse clearinghouse create
       7. create directory directory create
       8. create link link create
       9. create object object create
       10. create replica directory create -replica\e \& -clearinghouse
       11. define cached server cdscache create
       12. delete child directory remove
       13. delete clearinghouse clearinghouse delete
       14. delete directory directory delete
       15. delete link link delete
       16. delete object object delete
       17. delete replica directory delete -replica\e \& -clear
       18. dump clerk cache cdscache dump
       19. list child directory list
       20. list clearinghouse clearinghouse catalog
       21. list directory directory list
       22. list link directory list
       23. list object directory list
       24. remove directory directory modify
       25. remove link link modify
       26. remove object object modify
       27. set cdscp preferred \e set _s(cds) clearinghouse
       28. set directory directory modify
       29. set directory to skulk directory synchronize
       30. set link link modify
       31. set object object modify
       32. show cached clearinghouse cdscache show -clear
       33. show cached server cdscache show -server
       34. show cdscp preferred \e set _s(cds) clearinghouse
       35. show child directory show -child
       36. show clearinghouse clearinghouse show
       37. show directory directory show
       38. show link link show
       39. show object object show
       40. show replica directory show -replica -clear

       These are commands which don't have a mapping:

       1. disable clerk
       2. disable server
       3. set directory to new epoch
       4. show cdscp confidence
       5. show cell
       6. show clerk
       7. show server

       acl_edit

       These are commands that are mapped directly:

       1. assign acl replace -acl [cat filename]\*(f!

          The assign command has the ability to set the default cell of the ACL, this can be done using the -cell option on the acl replace command.

       2. cell acl modify -cell
       3. delete acl modify -remove
       4. get_access acl check
       5. kill_entries acl delete
       6. list acl show
       7. modify acl modify {-add | -change}
       8. permissions acl permissions
       9. purge acl purge
       10. substitute acl replace

       These are commands which don't have a mapping:

       1. abort not applicable
       2. commit not applicable, use RET
       3. test_access use acl check instead

       rgy_edit

       Principal, group, and organization commands

       These are commands that are mapped directly. In the following list pgo is used to mean one of: principal, group, or organization. Also, go is used to mean one of: group or organization.

       1. add pgo create
       2. change pgo modify
       3. delete pgo delete
       4. member go [add | remove]
       5. view pgo show/catalog
       6. adopt pgo create -uuid

       Account commands

       These are commands that are mapped directly:

       1. add account create
       2. cell registry connect
       3. change account modify
       4. delete account delete
       5. view account show/catalog

       Key management commands

       These are commands that are mapped directly (via a new dced related dcecp command):

       1. ktadd keytab create
       2. ktlist keytab show
       3. ktdelete keytab delete

       Miscellaneous commands

       These are commands that are mapped directly:

       1. auth_policy registry modify/show -policies
       2. login login
       3. policy registry modify/show -policies
       4. properties registry modify

       These are commands which don't have a mapping:

       1. defaults not needed, use scripts
       2. domain not needed, use separate objects
       3. scope not needed, use scripts

       Local registry commands

       These are commands which don't have a mapping:

       1. delete
       2. purge
       3. view

       dtscp

       These are commands that are mapped directly:

       1. advertise dts configure
       2. create now an option on dtsd\*(f!

          See DCE CR 8353.

       3. change clock set -abruptly
       4. delete dts stop
       5. disable dts deactivate
       6. enable dts activate
       7. set dts modify
       8. show dts/clock show
       9. synchronize dts/clock synchronize
       10. unadvertise dts configure
       11. update clock set

       sec_admin

       These are commands that are mapped directly:

       1. become -master registry set -master
       2. become -slave registry set -slave
       3. change_master registry set
       4. delrep registry delete
       5. delrep -force registry delete -force
       6. destroy registry delete -only
       7. info registry show -replica
       8. initrep registry synchronize
       9. lrep registry catalog
       10. lrep -prop registry show -master
       11. lrep -uuid registry show -replica
       12. lrep -state registry show -replica
       13. lrep -addr registry show -replica
       14. lrep -all registry dump
       15. master_key registry modify -key
       16. site set _s(sec)
       17. state registry enable/disable
       18. stop registry stop

       These are commands which don't have a mapping:

       1. monitor use script with loop and POSIX sleep

       LIST OF SECTION TITLES

       	1.	INTRODUCTION
       		1.1.	Changes Since Last Publication
       		1.2.	Changes For Later Drafts
       		1.3.	Not To Be Included
       
       	2.	TERMINOLOGY
       		2.1.	Abbreviations
       	3.	TARGET
       
       	4.	GOALS AND NON-GOALS
       
       	5.	REQUIREMENTS
       
       	6.	FUNCTIONAL DEFINITION
       
       	7.	DATA STRUCTURES
       		7.1.	Attributes
       		7.2.	ACL's
       			7.2.1.	String syntax
       			7.2.2.	Tcl syntax
       		7.3.	Bindings
       			7.3.1.	String syntax
       			7.3.2.	Tcl syntax
       		7.4.	Interface Identifiers
       			7.4.1.	String syntax
       			7.4.2.	Tcl syntax
       		7.5.	Serviceability Routing Specifiers
       			7.5.1.	String syntax
       			7.5.2.	Tcl syntax
       		7.6.	Debug Routing Specifiers
       			7.6.1.	String syntax
       			7.6.2.	Tcl syntax
       		7.7.	Other Data Types
       
       	8.	USER INTERFACES
       		8.1.	Invocation
       		8.2.	Initialization
       		8.3.	Command Syntax
       			8.3.1.	Object-operation vs. operation-object
       			8.3.2.	Attribute Lists and Options
       			8.3.3.	Lists of Lists
       		8.4.	Abbreviations
       		8.5.	Convenience Variables
       		8.6.	Error handling
       			8.6.1.	Warning Messages
       		8.7.	Help System
       		8.8.	Internationalization
       		8.9.	Common operations
       		8.10.	Common options
       		8.11.	Objects
       			8.11.1.	rpcentry
       			8.11.2.	rpcgroup
       			8.11.3.	rpcprofile
       			8.11.4.	endpoint
       			8.11.5.	object
       			8.11.6.	directory
       			8.11.7.	link
       			8.11.8.	clearinghouse
       			8.11.9.	cdscache
       			8.11.10.	principal
       			8.11.11.	group
       			8.11.12.	organization
       			8.11.13.	account
       			8.11.14.	registry
       			8.11.15.	xattrschema
       			8.11.16.	acl
       			8.11.17.	dts
       			8.11.18.	clock
       			8.11.19.	aud
       			8.11.20.	audfilter
       			8.11.21.	audevents
       			8.11.22.	audtrail
       			8.11.23.	log
       			8.11.24.	server
       			8.11.25.	hostdata
       			8.11.26.	keytab
       			8.11.27.	secval
       			8.11.28.	uuid
       			8.11.29.	name
       			8.11.30.	utc
       			8.11.31.	attrlist
       			8.11.32.	cdsalias
       			8.11.33.	Miscellaneous commands
       		8.12.	Tasks
       		8.13.	Command-line Editing Commands
       
       	9.	API'S
       
       	10.	REMOTE INTERFACES
       
       	11.	MANAGEMENT INTERFACES
       
       	12.	RESTRICTIONS AND LIMITATIONS
       
       	13.	OTHER COMPONENT DEPENDENCIES
       
       	14.	COMPATIBILITY
       
       	15.	STANDARDS
       
       	16.	OPEN ISSUES
       

       TCL COMMANDS

       Below is a list of generic Tcl commands for which the implementation depends merely on ANSI C. Task scripts will assume that all of these are implmented in dcecp:

       1. append
       2. array
       3. break
       4. case
       5. catch
       6. concat
       7. continue
       8. error
       9. eval
       10. expr
       11. for
       12. foreach
       13. format
       14. global
       15. history
       16. if
       17. incr
       18. info
       19. join
       20. lappend
       21. lindex
       22. linsert
       23. list
       24. llength
       25. lrange
       26. lreplace
       27. lsearch
       28. lsort
       29. proc
       30. regexp
       31. regsub
       32. rename
       33. return
       34. scan
       35. set
       36. split
       37. string
       38. switch
       39. trace
       40. unset
       41. uplevel
       42. upvar
       43. while

       These are the Tcl commands for whom the implementation depends on Unix System Calls. Task script implementation will try to avoid use of these if possible and will document any use of these in the porting guide.

       1. cd
       2. close
       3. eof
       4. exec
       5. exit
       6. file
       7. flush
       8. gets
       9. glob
       10. open
       11. pid
       12. puts
       13. pwd
       14. read
       15. seek
       16. source
       17. tell
       18. time

       REFERENCES

       [PORTG]

       DCE Porting and Testing Guide, Open Software Foundation, 1992.

       [PORTG]

       DCE User's Guide and Reference, Open Software Foundation, 1992.

       [POSIX.2]

       IEEE Std 1003.2 -- 1988, Portable Operating System Interface -- Shells and Utilities.

       [POSIX.6]

       IEEE Std 1003.6 -- 1991, Portable Operating System Interface -- Security Interface, Draft 12. and Utilities.

       [RFC 23]

       R. Mackey, DCE 1.1 Internationalization Guide, January 1993.

       [RFC 24]

       R. Salz, DCE 1.1 Serviceability Proposal, November 1992.

       [RFC 28]

       S. Luan, R. Weisz, A DCE Server Auditable-Event Identification and a Proposed Audit Logging API, December 1992.

       [RFC 29]

       S. Luan, R. Weisz, A Design of the DCE Audit Subsystem -- An Implementation Specification, December 1992.

       [RFC 30]

       H. Melman, DCE Administrative Improvement: Requirements for DCE Shell, December 1992.

       [RFC 34]

       H. Melman, DCE 1.1 Coding Style Guide, April 1993.

       [RFC 40]

       S. Martin, OSF Character and Code Set Registry, April 1993.

       [RFC 47.1]

       R. Salz, P. Wang, DCED: The DCE Host Daemon -- Command Set, January 1994.

       [RFC 47.3]

       R. Salz, P. Wang, DCED: The DCE Host Daemon -- Functional Specification, April 1994.

       [TCL]

       J. Ousterhout, Tcl: An Embeddable command Language, Proc. USENIX Winter Conference, January 1990, pp. 133-146.

       [TCL MAN]

       J. Ousterhout, tcl(3) -- overview of tool command language facilities, unpublished manual page, University of California at Berkeley, December 1992.

       [TCL BOOK]

       J. Ousterhout, Tcl and the Tk Toolkit, unpublished draft of book to be published by Addison-Wesley in early 1994.

       AUTHOR'S ADDRESS

       Howard Melman		Internet email: melman@osf.org
       Open Software Foundation		Telephone: +1-617-621-8989
       11 Cambridge Center
       Cambridge, MA 02142
       USA