CONSERVER(8)

📦
version 8.3.0 · 3 versions
, in epel 10, fedora 44

🌟 CONSERVER(8) — the console server daemon 🌟

okay so this is CONSERVER(8), from the conserver manual, section 8, which is the daemon section, and bestie she is the main character of console management. no cap. 👑

💖 NAME 💖

conserver — the console server daemon ✨

🎀 SYNOPSIS 🎀

       conserver [-7dDEFhinoRSuvV] [-a type] [-m max] [-M master] [-p port] [-b
       port] [-c cred] [-C config] [-P passwd] [-L logfile] [-O min] [-U
       logfile]

🦋 DESCRIPTION 🦋

okay so like, conserver is the daemon that manages remote access to system consoles for multiple users at once, through the console(1) client program, and (optionally, if you want) it logs the console output too. 📝

She can connect to consoles through literally so many vibes:

  • local serial ports
  • Unix domain sockets
  • TCP sockets (for terminal servers and the like)
  • any external program you want, periodt

🌸 how she wakes up 🌸

When started, conserver reads the conserver.cf(5) file for the deets on each console. The console type, logging options, serial or network parameters, and user access levels are just a few of the things you can specify in there. Then command-line options get applied on top, possibly overriding the conserver.cf(5) settings. iconic behavior honestly.

Then she sorts consoles into two buckets:

  1. consoles she should actively manage
  2. consoles she should just know about, so she can point clients at other conserver instances

The rule is: if the master value of a console matches the hostname or ip address of the local machine, conserver actively manages that console. Otherwise it's considered a ``remote'' console and it's managed by a different server. not her problem, she's just the messenger 💅

Conserver forks a child for each group of consoles it has to manage, and hands each process a port number to listen on. The max number of consoles per child process is set with the -m option. Then the console(1) client talks to the master console server process to find out the port (and the host too, in a multi-server setup) where the right child is listening.

🔐 access control, aka the vibe check 🔐

  • She restricts connections from clients based on the host access section of her conserver.cf(5) file.
  • She restricts users based on the console access lists in the conserver.cf(5) file.
  • She authenticates users against her conserver.passwd(5) file.
  • She can also restrict clients using the tcp-wrappers package — that's enabled with --with-libwrap.
⚠️ Important ordering deets: this authentication happens before consulting the conserver.cf(5) access list. so like, auth first, list second. don't get it twisted.

🧚 Unix domain sockets 🧚

When Unix domain sockets are used between the client and server (enabled with --with-uds), authentication checks are done against the hardcoded address ``127.0.0.1''. Automatic client redirection is also disabled (as if the -R option had been used), because the client literally cannot communicate with remote servers. 🚫

The directory used to hold the sockets gets checked to make sure it's empty when the server starts. And this is the important part bestie — the server will NOT remove any files in that directory itself, just in case the directory was accidentally specified as ``/etc'' or some other critical location. she's careful like that, she's not gonna delete your whole system. 🙈

She will do her best to remove all the sockets when she shuts down, but she could stop ungracefully (crash, ``kill -9'', etc) and leave files behind. And then it's up to the admin (or a creative startup script) to clean up the directory before the server will start again. 💀

🌈 conserver owns the connection, fully 🌈

conserver completely controls any connection to a console. All escape sequences given by the user to console are passed to the server without interpretation. The server is the one that recognizes and processes all escape sequences. so like, don't expect the client to do anything clever, she just forwards it. periodt.

⭐ respawning + signals ⭐

The conserver parent process will automatically respawn any child process that dies. mother energy fr. 🫶

The following signals are propagated by the parent process to its children:

  • SIGTERM — Close all connections and exit. bye bestie 👋
  • SIGHUP — Reread the configuration file. New consoles are managed by forking off new children, deleted consoles (and their clients) are dropped, and changes to consoles are done "in place", resetting the console port (bringing it down and up) only when necessary. The console name is what's used to determine when consoles have been added/removed/changed. All actions performed by SIGUSR2 are also performed. 🔄
  • SIGUSR1 — Try to connect to any consoles marked as down. This comes in handy if you had a terminal server (or more than one) that wasn't accepting connections at startup and you want conserver to try reconnecting to all those downed ports. 🩹
  • SIGUSR2 — Close and reopen all console logfiles and, if in daemon mode (the -d option), the error logfile (see the -L option). All actions performed by SIGUSR1 are also performed. 📂✨

😭 unloved errors 😭

Consoles with no current client connection might still produce important error messages. With the -u option, these ``unloved'' errors get labeled with a machine name and output on stdout (or, in daemon mode, to the logfile). This lets a live operator or an automated log scanner find otherwise unseen errors by watching in a single location. one place, all the drama. 👀

👑 who can run her 👑

conserver must be run as root if it needs to bind to a port under 1024, or if it must read protected password files (like shadow passwords) for authentication (see conserver.passwd(5)). Otherwise, it may be run by any user, with -p used to specify a port above 1024. so like, not-root is fine, just pick a big port number. 🎀

🔥 encryption era 🔥

If encryption has been built into the code (--with-openssl), encrypted client connections (without certificate exchanges) happen by default. To add certificate exchanges, use the -c option with the client and the server.

For authentication of the certificates to actually work, the signing certificate must be properly trusted, which usually means the public portion is in OPENSSL_ROOT/ssl/certs (on both the client and server sides). See the sample self-signing certificate making script contrib/maketestcerts for further clues. 🧾

To allow non-encrypted client connections (in addition to encrypted client connections), use the -E option.

💜 that's the end of part 1 bestie, don't go anywhere, there's more ✨

✨ OPTIONS ✨

okay bestie, here's the tea on how to feed conserver its options 🫶

You can hand these over as separate arguments (like -n -d) or clustered together (like -nd). Options and whatever arguments they eat can be separated by optional white space, no stress. But — and this is important — if an option argument has spaces or any other characters your shell thinks are ✨special✨, you gotta quote it. No cap.

  • -7 — strips the high bit off of all data received, whether it came from the console client or from the console device, before any processing happens at all. bye high bit 👋
  • -atype — sets the default access type for incoming connections from console clients. Your choices are r for refused (this is the default, so rude), a for allowed, or t for trusted. This kicks in for hosts where nothing matching shows up in the access section of conserver.cf(5).
  • -bport — sets the base port for children to listen on. Each child starts hunting for free ports at port and works its way upward, trying a max number of ports equal to twice the maximum number of groups. If it can't find a free port anywhere in that range? conserver exits, periodt. By default, conserver just lets the operating system pick a free port for it. king behavior honestly 👑
  • -ccred — loads an SSL certificate and key from the PEM encoded file cred.
  • -Cconfig — reads configuration info from the file config. The default config can be changed at compile time with the --with-cffile option.
  • -d — become a daemon 💅. Disconnects from the controlling terminal and sends all output (yes, including any debug output) to the logfile (peep -L).
  • -D — enables debugging output, sent to stderr. Stack multiple -D options and the debug output gets louder and louder. more D's, more drama 🔥
  • -E — if encryption got built into the code (--with-openssl), then encrypted client connections are a requirement. This option lets non-encrypted clients (as well as encrypted ones, obviously) connect to consoles.
  • -F — do not automatically reinitialize failed (unexpectedly closed) consoles. BUT — if the console is a program (that's the | syntax) and it closes with a zero exit status, the console gets reinitialized anyway, no matter what this option says. Without -F, a console is immediately reopened, and if that fails it's retried every minute until it works. This option has no effect on the -o and -O options.
  • -h — outputs a brief help message. short n sweet 🍓
  • -i — initiates console connections on demand (and closes them when they're not being used).
  • -Llogfile — logs errors and informational messages to logfile after startup in daemon mode (-d). This option does not apply when you're not running in daemon mode. The default logfile can be changed at compile time using the --with-logfile option.
  • -mmax — sets the maximum consoles managed per process. The default max can be changed at compile time using the --with-maxmemb option.
  • -Mmaster — normally this lets conserver bind to a particular IP address (like 127.0.0.1) instead of all interfaces. The default is to bind to all addresses. However — if --with-uds was used to enable Unix domain sockets for client/server communication, then this points conserver to the directory where it should store the sockets. The default master directory (/tmp/conserver) can be changed at compile time using the --with-uds option.
  • -n — obsolete (now a no-op); go look at -u.
  • -o — normally, a client connecting to a downed'' console just... does that. With this option, the server will automatically attempt to open (bring up'') the console when the client connects. teamwork 🫶
  • -Omin — enables periodic attempts (every min minutes) to open (``bring up'') all downed consoles (similar to sending a SIGUSR1). Without this option, or if min is zero, no periodic attempts happen at all.
  • -pport — sets the TCP port for the master process to listen on. This can be either a port number or a service name. The default port, ``conserver'' (typically 782), can be changed at compile time using the --with-port option. If the --with-uds option was used, this option is ignored.
  • -Ppasswd — reads the table of authorized user data from the file passwd. The default passwd can be changed at compile time using the --with-pwdfile option.
  • -R — disables automatic client redirection to other conserver hosts. Which means informational commands like -w and -i will only show the status of the local conserver host, and any attempt to connect to remote consoles just gives the user an informative message instead.
  • -S — do not run the server, just do a syntax check of the configuration file and exit with a non-zero value if there's an error. Using more than one -S makes conserver output various info about each console in 5 colon-separated fields, all wrapped up in curly-braces. The philosophy here is to hand you enough info that some external thing can detect when multiple consoles are accessing the same physical port — because that's so environment-specific, conserver can't do that check internally. so it outsources it, iconic ✨

The fields are:

  • name — the name of the console.
  • master — the hostname of the master conserver host for the console.
  • aliases — the console aliases in a comma-separated list.
  • type — the type of console. Values will be a / for a local device, | for a command, ! for a remote port, % for a Unix domain socket, and # for a noop console.
  • details — multiple values, comma-separated, and they depend on the type of the console. Local devices will have the values of the device file and baud rate/parity. Commands will have string to invoke. Remote ports will have the values of the remote hostname and port number. Unix domain sockets will have the path to the socket. Noop consoles will have nothing. (nothing! 💀)
  • -u — sends unloved console output to conserver's stdout (which, in daemon mode, is redirected to the logfile). This applies to all consoles that have no user attached, independent of whether logging of individual consoles is enabled via conserver.cf entries.
  • -Ulogfile — copies all console data to the ``unified'' logfile. The output is the same as the -u output, but all consoles get logged, not just the ones without a user. Every line of output is prefixed with the console name. And if a user is attached read/write, a * gets appended to the console name — that's so log watching utilities can ignore potential user-introduced alarms. thoughtful ✨
  • -v — echoes the configuration as it's being read (be verbose).
  • -V — outputs the version number and settings of the conserver program, then exits.

🌈 PROTOCOL 🌈

okay so the protocol used to talk to the conserver daemon has two basic styles, and you need to know both:

  1. the initial line-based mode, which happens <em>before</em> you connect to a console
  2. the character-based, escape-sequence mode, which is what you get <em>while</em> connected to a console

The initial line-based mode kicks off the same way for both the master process and its children. Once a client connects successfully (and isn't rejected), an ok'' is sent. Then the client issues a command and the server responds with a result string (ok'' being the sign of success for most commands). The commands you get are help'', ssl'' (if SSL was built into the code), login'', and exit''. Using the login'' command, the client authenticates and unlocks the extended command set — and <hotpink>this</hotpink> is where the master process and its children start to differ. The master process hands the client access to global commands, while the child provides commands for interacting with the consoles it manages. The help'' command, in both cases, gives you a complete list of commands plus a short description of what each one does. bestie behavior honestly 📖

The second, character-based style of interaction happens when the client issues the ``call'' command with a child process. That command connects the client to a console, and from that point on it just relays all traffic between the client and the console. There is no more command-based interaction between client and server after that — any interaction with the server goes through the default escape sequence.

And no, this is by no means a complete description of the entire client/server interaction. It's just a brief explanation so you get an idea of what the program actually does. For the full details, go read the PROTOCOL file in the distribution.

📁 FILES 📁

These default file locations can be overridden at compile time or by the command-line options described above. Run conserver -V to see the defaults that got baked in at compile time. 👀

  • /etc/conserver.cf — description of console terminal lines and client host access levels; see conserver.cf(5).
  • /etc/conserver.passwd — users allowed to access consoles; see conserver.passwd(5).
  • /var/run/conserver.pid — the master conserver process ID
  • /var/log/conserver — log of errors and informational messages
  • /tmp/conserver — directory to hold Unix domain sockets (if enabled)

Also, output from individual consoles can be logged to separate files specified in conserver.cf(5). slay 💅

🐛 BUGS 🐛

I'm sure there are bugs, I just don't know where they are. Please let me know if you find any. 😭 (fr fr, they're out there lurking)

👑 AUTHORS 👑

  • Thomas A. Fine, Ohio State Computer Science
  • Kevin S Braunsdorf, Purdue University Computing Center
  • Bryan Stansell, conserver.com

🦋 SEE ALSO 🦋

console(1), conserver.cf(5), conserver.passwd(5)

and that's a wrap bestie!! 🎀 this whole page is from conserver-8.3.0, dated 2026/02/02 — go forth and manage those consoles, you absolute icon 💖✨

📦 where this page comes from