CONSERVER.CF(5)

📦
version 8.3.0 · 3 versions
, in epel 10, fedora 44

🌸 NAME 🌸

conserver.cf — the console configuration file for conserver(8). It's literally the group chat rules for your console server, bestie 💖

✨ DESCRIPTION ✨

okay so here's the tea: the format of the conserver.cf file is made up of named blocks of keyword/value pairs, comments, and optional whitespace so you can format it however you want. The block types and the keywords are pre-defined — you don't get to invent them — and they're all explained down in the BLOCKS section. A comment is just an unquoted pound-sign that runs all the way to a newline. And if you want the full rundown on whitespace and quoting, the PARSER section has you covered 🫶

Let me first show you a sample block with a couple of keyword/value pairs to make the description a bit simpler to understand.

console simple { master localhost; type exec; rw *; }

That right there is actually a fully functional conserver.cf file (if certain conditions are met... and if you can list those conditions, you can probably skip to the BLOCKS section 😌).

Our example is made up of a console-block named simple'' with three keyword/value pairs. What it does: it defines a console named simple'', makes the master of that console the host ``localhost'', makes the type an exec-style console, and gives every user read/write permission. This is the generic format of the file:

block-type block-name { keyword value; ... }

Now, to show you what adding comments and whitespace looks like, here's the same example reformatted (but functionally equivalent, no cap):

# define a console named "simple"
console simple {
    # setting all required values...
    master localhost;
    type exec;  # exec-style console
    rw *;       # allow any username
}

🎀 PARSER 🎀

The parser has six characters that it considers special. They are: {'', }'', ;'', #'', \'', and "''. The first three (hereby called tokens) define the format of the configuration blocks and get used as word separators. The next one is the comment character. And the last two? Quoting characters, obviously 💅

Word separation happens when the parser hits an unquoted token and, in certain cases, whitespace. And here's the plot twist: whitespace is only used as a word separator when the parser is looking for a block-type or a keyword. When it's looking for a block-name or a value, whitespace is just like any other character — which means you can embed whitespace in a block-name or value without having to quote it. Iconic. Example:

default my defs { rw *; include other defs  ; }

So the block-type is default'', the block-name is my defs'', and the value for the keyword include'' is other defs''. Whitespace around tokens gets ignored, which is why you get other defs'' and <hotpink>not</hotpink> other defs '' as the value. Slay.

The only way to use one of the special characters as part of a block-name or value is to quote it.

Quoting is a simple matter of prefixing a character with a backslash or surrounding a group of characters with double-quotes. If a character is prefixed by a backslash, the next character is a literal (so \\'' produces a '', \"'' produces a "'', \{'' produces a {'', etc.). For double-quoted strings, all characters are literal except for ``"'', which embeds a double-quote.

Adding a variety of quotes to our example without changing the meaning of things, we get:

"defa"ult my\ defs { rw *; in\clude "other defs"  ; }

There is one special line the parser recognizes: a ``#include'' statement. It is of the form:

#include filename

Any whitespace around filename is ignored, but whitespace embedded inside is preserved. Everything in filename is taken literally, so none of the normal parser quoting applies. The #include must begin in ``column 0'' — no whitespace is allowed between it and the start of the physical line. And there's an include file depth limit of 10 to prevent infinite recursion. (we love a safety net 🧚)

🦋 BLOCKS 🦋

  • access hostname|ipaddr — define an access block for the host named hostname or using the address ipaddr. If the value of ``*'' is used, the access block gets applied to all conserver hosts. Access lists work in a first-match fashion (top down), so the order is important — do not skip this.
    • admin [!]username[,...]|"" — define a list of users making up the admin list for the console server. If username matches a previously defined group name, all members of the previous group are applied to the admin list (with access reversed if prefixed with a !''). If *username* doesn't match a previously defined group and *username* begins with @'', the name (minus the @'') is checked against the host's group database, and all users found in that group will be granted (or denied, if prefixed with !'') access. If username doesn't match a previous group and doesn't begin with @'', the users will be granted (or denied, if prefixed with !'') access. And if the null string (``""'') is used, any users previously defined for the console server's admin list are removed.
    • allowed hostname[,...] — the list of hostnames are added to the ``allowed'' list, which grants connections from the hosts but requires username authentication. 🔐
    • include accessgroup — the access lists defined using the name accessgroup are applied to the current access block. Heads up: the included access block has to be previously defined.
    • limited [!]username[,...]|"" — define a list of users with limited functionality on the console server. These users will not be allowed to suspend their connection, shift to another console, or attach to a local command. If username matches a previously defined group name, all members of the previous group are applied to the admin list (yes, it says admin list here, i'm just the messenger 🙈) (with access reversed if prefixed with a !''). If *username* doesn't match a previously defined group and *username* begins with @'', the name (minus the @'') is checked against the host's group database, and all users found in that group will be granted (or denied, if prefixed with !'') access. If username doesn't match a previous group and doesn't begin with @'', the users will be granted (or denied, if prefixed with !'') access. And if the null string (``""'') is used, any users previously defined for the console server's limited list are removed.
    • rejected hostname[,...] — the list of hostnames are added to the ``rejected'' list, which rejects connections from the hosts. bye ✋
    • trusted hostname[,...] — the list of hostnames are added to the ``trusted'' list, which grants connections from the hosts without username authentication.
  • break n — define a break sequence where (1 <= n <= 9) or (a <= n <= z). Break sequences are accessed via the ``^Ecln'' client escape sequence. 💅
    • confirm yes|true|on|no|false|off — set whether or not to ask the client for confirmation before sending the break sequence. The default is ``no''.
    • delay n — set the time delay for the \d sequence to n milliseconds. The default time delay is 250ms.
    • string breakseq — assign the string breakseq to the specified slot n. A break sequence is a simple character string with the exception of \ and ^:
\a    alert
\b    backspace
\d    delay specified by the delay option.
\f    form-feed
\n    newline
\r    carriage-return
\t    tab
\v    vertical-tab
\z    serial break
\\    backslash
\^    circumflex
\ooo  octal representation of a character (where
      ooo is one to three octal digits)
\c    character c
^?    delete
^c    control character (c is ``and''ed with 0x1f)
  • config hostname|ipaddr — define a configuration block for the host named hostname or using the address ipaddr. If the value of ``*'' is used, the configuration block gets applied to all conserver hosts.
    • autocomplete yes|true|on|no|false|off — turn the console name autocompletion feature on or off. If autocompletion is on, a client can use any unique leading portion of a console name when connecting to a console. Autocompletion is on by default.
    • defaultaccess rejected|trusted|allowed — set the default access permission for all hosts not matched by an access list (see the -a command-line flag).
    • daemonmode yes|true|on|no|false|off — set whether or not to become a daemon when run (see the -d command-line flag).
    • initdelay number — set the number of seconds between console initializations. All consoles with the same host value will be throttled as a group (those without a host value are their own group). In other words, each console within a group will only be initialized after number seconds passes from the previous initialization of a console in that group. Different throttle groups are initialized simultaneously.
⚠️ One warning, bestie: since consoles are split up and managed by separate conserver processes, it's possible for more than one conserver process to have a throttle group based on a particular host value. If that happens, each conserver process will throttle their groups independently of the other conserver processes, which results in a more rapid initialization (per host value) than one might otherwise expect.

If number is zero, all consoles are initialized without delay.

  • logfile filename — set the logfile to write to when in daemon mode (see the -L command-line flag).
  • passwdfile filename — set the password file location used for authentication (see the -P command-line flag).
  • primaryport number|name — sets the port the master conserver process lives on (that's the -p command-line flag, bestie 💅).
  • redirect yes|true|on|no|false|off — flips redirection on or off (the -R command-line flag).
  • reinitcheck number[s|m] — how many minutes between reinitialization checks (yep, the -O command-line flag). If you slap an s or m after number, that time gets read as seconds or minutes instead. ✨
  • secondaryport number|name — sets the base port number that child processes use (the -b command-line flag).
  • setproctitle yes|true|on|no|false|off — decides whether the process title flexes master/group functionality, the port number it's listening on, and how many consoles it's managing. Heads up: your OS has to actually support the setproctitle() call for this to work 🫶.
  • sslcredentials filename — sets where the SSL credentials file lives (the -c command-line flag).
  • sslcacertificatefile filename — loads the valid CA certificates for the SSL connection out of that PEM encoded file. This one overrides the global CA list, no cap.
  • sslreqclientcert yes|true|on|no|false|off — sets whether the client needs a certificate to connect. Default is no'' `` 🌸.
  • sslrequired yes|true|on|no|false|off — sets whether encryption is required when talking to clients (the -E command-line flag).
  • unifiedlog filename — sets where the unified log goes. Peep the -U command-line flag for the deets.

console name 💖

Defines a console identified as name. The keywords are the exact same as the default block, plus this one little addition:

  • aliases name[,...]|"" — defines a whole list of console aliases. If you use the null string (""), any aliases that were previously defined for that console get yeeted 🧚.

default name 🌈

Defines a block of defaults identified as name. And if name is *, you're defining the automatically applied default block — which basically means every console has an implicit include "*"; chilling at the beginning of its definition. Iconic.

  • baud 300|600|1800|2400|4800|9600|19200|38400|57600|115200|..|4000000 — assigns the baud rate to the console. Only consoles of type device'' `` will actually use this value.
  • break n — assigns break sequence n as the default for the console, which is what the ^Ecl0'' `` client escape sequence uses.
  • breaklist n[,...]|"" — hooks up a list of break sequences referenced by n to the console. If you use * (the default), every defined break sequence is available. If you use the null string (""), none of them are.
  • device filename — assigns the serial device filename as the path to the console. Only consoles of type device'' `` will use this value.
  • devicesubst c=t[n]f[,...]|"" — does character substitutions on the device value. You can define a whole series of replacements by giving a comma-separated list of c=t[n]f sequences, where c is any printable character, t says what the replacement value is, n is an optional field length, and f is the format string. And t can be one of the characters below — they're sorted into string replacements or numeric replacements, which is what decides whether the n and f fields even get used. Lowkey elegant 💜

String Replacement

  • c — console name
  • h — host value
  • r — replstring value

Numeric Replacement

  • b — baud value
  • p — config port value
  • P — calculated port value

For string replacements, if the replacement isn't at least n characters, it gets padded with space characters on the left. And f must be s. For numeric replacements, the value gets formatted to at least n characters, padded with 0s if n begins with a 0, and space characters otherwise. f must be either d, x, X, a, or A, specifying a decimal, lowercase hexadecimal (0-9a-f), uppercase hexadecimal (0-9A-F), lowercase alphanumeric (0-9a-z), or uppercase alphanumeric (0-9A-Z) conversion. If you use the null string (""), no replacements happen at all.

  • exec command|"" — assigns the string command as the command used to access the console. Conserver runs it by invoking /bin/sh -ce "command"'' . If you use the null string ("") or you just don't specify an `exec` keyword, conserver falls back to /bin/sh -i'' . Only consoles of type exec'' `` will use this value.
  • execrunas [user][:group]|"" — by default, the command invoked by exec runs with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user can be a username or a numeric uid, and group can be a group name or a numeric gid. Either one is optional. If the server is not running with root privileges, these values just get ignored. And if you specify the null string (""), you're back to the default of running with the same privileges as the server.
  • execsubst c=t[n]f[,...]|"" — does character substitutions on the exec value. Go look at the devicesubst option for how that format string works. Null string ("") means no replacements, periodt.
  • host hostname — assigns hostname as the host to connect to for accessing the console. You must also set the port option for consoles of type host'' . Normally only consoles of type host'' and ipmi'' `` use this value — but if the devicesubst, execsubst, or initsubst keywords are used in any console type, then this value gets used too.
  • idlestring string|"" — assigns the string that gets sent to the console once the console has been idle for an idletimeout amount of time. If you use the null string (""), the string is unset and the default takes over. The string gets interpreted exactly the way a break string is interpreted (check the break configuration items for that), where every delay specified via \d'' uses the default delay time. Default string is \n'' .
  • idletimeout number[s|m|h] — sets the idle timeout of the console to number seconds. If you toss an s, m, or h after number, that time gets read as seconds, minutes, or hours. Set the timeout to zero to disable the idle timeout — which is the default, bestie ✨
  • ipmiciphersuite number — sets the IPMI cipher suite. Syntactically valid values are -1 (the default) and greater. Check the FreeIPMI documentation for the usable values.
  • ipmikg string|"" — sets the BMC authentication key K_g to string. A K_g value is a plain character string, with one exception: the backslash \:
    • \\ — backslash
    • \ooo — octal representation of a character (where ooo is one to three octal digits)
    • \c — character c

The resulting value has to be no more than 20 characters. The null string ("") is the default.

  • ipmiworkaround [!]option[,...]|"" — you can turn a workaround off by sticking a !'' `` character in front of it. So to turn off the integrity workaround, you'd write !integrity. Here are the valid options and how they map to FreeIPMI settings:
    • activation-status — SKIP_SOL_ACTIVATION_STATUS
    • auth-capabilites — AUTHENTICATION_CAPABILITIES
    • channel-payload — SKIP_CHANNEL_PAYLOAD_SUPPORT
    • checksum — NO_CHECKSUM_CHECK
    • default — DEFAULT
    • ignore-payload-size — IGNORE_SOL_PAYLOAD_SIZE
    • ignore-port — IGNORE_SOL_PORT
    • integrity — NON_EMPTY_INTEGRITY_CHECK_VALUE
    • intel-session — INTEL_2_0_SESSION
    • packet-sequence — INCREMENT_SOL_PACKET_SEQUENCE
    • privilege — OPEN_SESSION_PRIVILEGE
    • serial-alerts — SERIAL_ALERTS_DEFERRED
    • sun-session — SUN_2_0_SESSION
    • supermicro-session — SUPERMICRO_2_0_SESSION

If you don't specify any ipmiworkaround, the default'' workaround gets used. The null string ("") unsets **all** workarounds, including default'' . See the FreeIPMI documentation for the details on what each workaround actually affects 💅

  • ipmiprivlevel user|operator|admin — sets the privilege level for the username used during IPMI authentication. Default privilege level is admin'' ``.
  • include default — the default block defined using the name default gets applied to the current console or default block. Heads up: the included default block has to have been previously defined. No time travel allowed 🙈
  • initcmd command|"" — invokes command as soon as the console is brought up, redirecting the console to stdin, stdout, and stderr of command. The command gets passed as an argument to /bin/sh -ce'' . If you use the null string (""``), the command is unset and nothing gets invoked.
  • initrunas [user][:group]|"" — okay so by default, the command from initcmd runs with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user can be a username or numeric uid, and group can be a group name or numeric gid. Either one is optional. If the server is not running with root privileges, these values are not used. If the null string ("") is specified, the default of running with the same privileges as the server is restored. 💅
  • initspinmax n|"" — set the max number of spins allowed for the console to n, where 0 <= n <= 254. A console is "spinning" if an attempt to initialize it happens in under initspintimer seconds from its previous initialization, and this quick init happens initspinmax times in a row. If at any point the time between initializations is greater than initspintimer, the counter for reaching initspinmax resets to zero. When a console is "spinning" it is forced down. If the null string ("") is specified, the default of 5 is used. 🌀
  • initspintimer t|"" — set the number of seconds a console must be "up" to not be considered "spinning" to t, where 0 <= t <= 254. See initspinmax for the full description of console "spinning." If the null string ("") is specified, the default of 1 is used. ⏱️
  • initsubst c=t[n]f[,...]|"" — perform character substitutions on the initcmd value. See the devicesubst option for an explanation of the format string. If the null string ("") is used, no replacements will be done. ✨
  • logfile filename|"" — assign the logfile specified by filename to the console. Any occurrence of & in filename gets replaced with the name of the console. If the null string ("") is used, the logfile name is unset and no logging will occur. 📝
  • logfilemax number[k|m] — enable automatic rotation of logfile once its size exceeds number bytes. Specifying k or m interprets number as kilobytes and megabytes. number must be at least 2048 bytes. A value of zero will turn off automatic rotation of logfile. The logfile filename will be renamed filename-YYYYMMDD-HHMMSS, where the extension is the current GMT year, month, day, hour, minute, and second (to prevent issues with clock rollbacks). File sizes are checked every 5 minutes with an additional initial pseudo-random delay of up to one minute (to help prevent all processes checking all consoles simultaneously). 2.5% (minimum 100 bytes, maximum 4000 bytes) of the old logfile is read from the end of the file. All data past the first newline is moved (not copied) to the new logfile so that a replay of the console works and starts on a line boundary. 🔄
  • master hostname|ipaddr — define which conserver host manages the console. The host may be specified by hostname or using the address ipaddr. 👑
  • motd message|"" — set the "message of the day" for the console to message, which gets displayed when a client attaches to the console. If the null string ("") is used, the MOTD is unset and no message will occur. 💬
  • options [!]option[,...]|"" — you can negate the option by prefixing it with a ! character. So, to turn off the hupcl flag, you would use !hupcl. The following are valid options:
    • ixon — enable XON/XOFF flow control on output. Only consoles of type device or exec will use this value. Default is ixon. 🌊
    • ixany — enable any character to restart output. Only consoles of type device or exec will use this value. Default is !ixany. 🚦
    • ixoff — enable XON/XOFF flow control on input. Only consoles of type device or exec will use this value. Default is ixoff for consoles of type device and !ixoff for consoles of type exec. 🎛️
    • crtscts — enable RTS/CTS (hardware) flow control. Only consoles of type device will use this value. Default is !crtscts. 🔌
    • cstopb — set two stop bits, rather than one. Only consoles of type device will use this value. Default is !cstopb. ✌️
    • hupcl — lower modem control lines after last process closes the device (hang up). Only consoles of type device will use this value. Default is !hupcl. 📴
    • ondemand — initialize the console when a client requests a connection to the console. When no clients are connected, bring the console down. The conserver option -i will set this flag for all consoles. Default is !ondemand. ⚡
    • striphigh — strip the high bit off all data coming from this console and all clients connected to this console before processing occurs. The conserver option -7 will set this flag for all consoles. Default is !striphigh. ✂️
    • reinitoncc — automatically reinitialize ("bring up") a downed console when a client connects. Without this option, a client will be attached to the downed console and will need to manually reinitialize the console with an escape sequence. The conserver option -o will set this flag for all consoles. Default is !reinitoncc. 🔁
    • autoreinit — allow this console to be automatically reinitialized if it unexpectedly goes down. If the console doesn't come back up, it is retried every minute. A console of type exec that exits with a zero exit status is automatically reinitialized regardless of this setting. The conserver option -F will unset this flag for all consoles. Default is autoreinit. ♻️
    • unloved — enable the sending of this console's output (prefixed with its name) to the daemon's stdout (or the logfile if in daemon mode) when no clients are connected to the console. The conserver option -u will set this flag for all consoles. Default is !unloved. 💔
    • login — allow users to log into this console. If logins are not allowed, conserver will send a generic message to the client saying so and terminate the connection. You can override the generic message by setting the motd message. Default is login. 🔑
  • parity even|mark|none|odd|space — set the parity option for the console. Only consoles of type device will use this value. ⚖️
  • password password|"" — use password during IPMI authentication. If the null string ("") is used (the default), no password will be used. 🔐
  • passwordfile filename|"" — read the IPMI password from filename. The first line of the file will be used as the password with trailing whitespace stripped. If both password and passwordfile are specified, passwordfile takes precedence. If the null string ("") is used (the default), no password file will be used. 📄
  • port number|name — set the port used to access the console. The port may be specified as a number or a name. A name will cause a getservbyname(3) call to look up the port number. The port, portbase, and portinc values are all used to calculate the final port number to connect to. The formula used is finalport = portbase + portinc * port. By using proper values in the formula, you can reference ports on a terminal server by their physical numbering of 0..n or 1..n (depending on if you like zero-based or one-based numbering). Warning: you can generate a -1 value with this formula, which will become a very high numbered positive value (since things are stored unsigned). You must also set the host option as well. Normally, only consoles of type host will use this value, however if the devicesubst, execsubst, or initsubst keywords are used in any console type, this value is used. 🚨
  • portbase number — set the base value for the port calculation formula. number must be 0 or greater. The default is zero. See port for the details of the formula. 🧮
  • portinc number — set the increment value for the port calculation formula. number must be 0 or greater. The default is one. See port for the details of the formula. ➕
  • protocol telnet|raw — sets which protocol carries your data to and from the console. Pick raw and literally everything goes out as is'', zero protection, no protocol spec wrapping it up. Pick telnet (and that's the default, bestie) and your data gets encapsulated in the telnet protocol. Heads up though: the striphigh console option still applies when the server reads data, and if it's enabled it can mess with the encapsulation process. 💅
  • replstring string — a generic replacement string that the devicesubst, execsubst, and initsubst keywords can all use. One string, three vibes.
  • ro [!]username[,...]|"" — defines the list of users who make up the console's read-only access list. Here's how the matching works, stay with me:
    • If username matches a previously defined group name, all members of that previous group get applied to the read-only access list (with access reversed if it's prefixed with a !).
    • If username doesn't match a previously defined group and begins with @, then the name (minus the @) gets checked against the host's group database, and all users found in that group are granted read-only access — or denied, if prefixed with !.
    • If username doesn't match a previous group and doesn't begin with @, those users just get granted read-only access — or denied, if prefixed with !.
    • And if you use the null string (``""''), every user previously defined for the console's read-only list gets removed. Poof. Gone.
  • rw [!]username[,...]|"" — same whole deal as ro above, except it's the console's read-write access list. So:
    • username matching a previously defined group name → all members of that previous group get applied to the read-write access list (access reversed if prefixed with !).
    • Not a match for a previous group and starts with @ → the name minus the @ gets checked against the host's group database, and all users found in the group are granted read-write access (denied if prefixed with !).
    • Not a match for a previous group and doesn't start with @ → those users are granted read-write access (denied if prefixed with !).
    • Null string (``""'') → any users previously defined for the console's read-write list are removed. ✨
  • tasklist c[,...]|"" — associates a list of tasks (referenced by c) with the console. Use * and that's the default, meaning every defined task is available. Use the null string (``""'') and no tasks will be available.
  • timestamp [number[m|h|d|l]][a][b]|"" — controls the time between timestamps slapped onto the console log file, and whether read/write connection actions get logged too. The timestamps come out looking like this:
[-- MARK -- Mon Jan 25 14:46:56 1999]

The m, h, and d tags mean minutes''</purple> (that's the default), <purple>hours'', and days''</purple>. The `l` tag means <purple>lines'', and it makes timestamps shaped like this get placed every number lines (a newline character is what signifies a new line):

[Mon Jan 25 14:46:56 PST 1999]

So 5h = every five hours, and 2l = every two lines. Fancy. Now for the letters: an a can be specified to add logs of attached''</mint>, <mint>detached'', and ``bumped'' actions, including the user's name and the host the client connection came from. A b can be specified to add logging of break sequences sent to the console. 🫶

  • type device|ipmi|exec|host|noop|uds — sets the type of console. Which one do you want, bestie? Here's the whole menu:
    • device — for local serial ports (and you also set the device value).
    • ipmi — for IPMI serial over LAN consoles (also set the host value, and possibly username, password, and the ipmi* values).
    • exec — for command invocations (maybe also set the exec value).
    • host — for terminal servers and other TCP socket-based interaction (also set the host and port values).
    • noop — a placeholder. It does nothing, ignores any logfile value, and forces the !nologin option (so you might wanna set the motd value instead).
    • uds — for Unix domain sockets (also set the uds option).
  • uds filename — assigns the Unix domain socket filename as the path to the console. Only consoles of type uds will actually use this value.
  • udssubst c=t[n]f[,...]|"" — performs character substitutions on the uds value. Go read the devicesubst option for the explanation of that format string. Use the null string (``""'') and no replacements will be done.
  • username username|"" — uses username during IPMI authentication. If you use the null string (""''</pink>) — which is the default — then the <purple>null'' user gets used. 😌

🌈 group name

Defines a user group identified as name. Iconic little container for people.

  • users [!]username[,...]|"" — defines the list of users making up the group name. The matching rules are the same energy as ro/rw:
    • If username matches a previously defined group name, all members of that previous group get applied to the current group (access reversed if prefixed with a !).
    • If it doesn't match a previously defined group and username begins with @, the name (minus the @) gets checked against the host's group database, and all users found in that group are recorded with access — or without, if prefixed with !.
    • If it doesn't match a previous group and doesn't begin with @, the users are recorded with access — or without, if prefixed with !.
    • Null string (``""'') → any users previously defined for this group are removed.

🎀 task c

Defines a task, where c is a lowercase alphanumeric character (that's 0-9a-z). Tasks get invoked through the ``^Ec!c'' client escape sequence. Periodt.

  • cmd command|"" — invokes command on the server when the client tells it to. Every file descriptor is closed, except for stderr (which is inherited from the server). The command gets passed as an argument to /bin/sh -ce''</cyan>, and it's a <purple>fire and forget'' methodology — meaning you need to check the logs for any issues, because it will not come back and tell you. If you use the null string (``""''), the entire task definition is ignored.
  • confirm yes|true|on|no|false|off — sets whether or not to ask the client for confirmation before invoking the task. Default is ``no''.
  • description string — sets a description for the task. When a client lists tasks, string gets printed instead of the command defined above. If you use the null string (``""''), the command defined above gets printed instead.
  • runas [user][:group]|"" — by default, the command invoked by cmd runs with the same privileges as the server. If the server is running with root privileges, this option resets the user and/or group of the invoked process to user and group respectively. user can be a username or a numeric uid, and group can be a group name or a numeric gid. Either one is optional. If the server is not running with root privileges, these values are just not used. If the null string (``""'') is specified, the default of running with the same privileges as the server gets restored. 💅
  • subst c=t[n]f[,...]|"" — performs character substitutions on the cmd value. Again, see the devicesubst option for the explanation of that format string. Null string (``""'') → no replacements will be done.

👑 AUTHORS

Bryan Stansell, conserver.com

🔍 SEE ALSO

console(1), conserver.passwd(5), conserver(8)

okay bestie that's literally the whole page, you ate it 🍓✨ this was CONSERVER.CF(5) from conserver-8.3.0, dated 2026/02/02 — go forth and configure your consoles with main character energy 💖🦋

📦 where this page comes from