.. _commands:

Commands on the ThinLinc Server
===============================

In this chapter, we will describe the commands shipped as part of the
ThinLinc server that are meant for the common user.

Commands in /opt/thinlinc/bin
-----------------------------

tl-session-param [*options*] <*parameter*>
   The :program:`tl-session-param` command is used to access the session
   information managed by the VSM server. This includes information sent
   by the client, such as if the client has exported any local drives,
   or what language is set on the client side. This command is used by
   for example :program:`tl-set-clientlang.sh`, documented later in this
   chapter.

tl-config [*options*] <*parameter*>
   The :program:`tl-config` command is used to access configuration
   parameters used by the ThinLinc system. It is also used to set
   parameters from scripts, and can be used instead of an editor when
   some parameter needs to be changed. :program:`tl-config` uses
   :program:`hivetool`, part of the Hiveconf system. See
   :ref:`hiveconf` for more information about Hiveconf.

tl-desktop-restore
   When a user's Gnome or KDE desktop needs to be reset to default, the
   command :program:`tl-desktop-restore` can be run. This will move the
   settings directories for KDE and Gnome to a backup directory named
   :file:`~/.old-thinlinc-desktop` in the user's home directory, which
   will make both Gnome and KDE revert to the default settings.

tl-limit-printers
   This command is run by VSM Server at session startup and reconnect if
   the Printer Access Control feature of ThinLinc is activated. See
   :ref:`printeraccesscontrol` for details.

tl-memberof-group <*groupname*> [*groupname*...]
   This command can be used to determine if the current user is a member
   of the specified groups. It returns true (0) if the user is a member
   of any of the groups, false (1) if the user is not a member and false
   (2) if any of the specified groups do not exists.

tl-run-xstartup.d
   This command is run by the default session startup file
   (:file:`/opt/thinlinc/etc/xstartup.default`) to execute all start
   scripts in the directory :file:`/opt/thinlinc/etc/xstartup.d/`.
   Files with the suffix :file:`.sh` will be sourced. All other files
   will be executed.

tl-select-profile
   This command is run by the session setup file
   (:file:`/opt/thinlinc/etc/xstartup.default` or
   :file:`~/.thinlinc/xstartup`) and provides a menu where the user can
   choose what kind of session to run. See
   :ref:`configuration_customizing_user_session` for more information.

tl-set-clientlang.sh
   By creating a symlink from :file:`/opt/thinlinc/etc/xstartup.d` to
   this command, the user's :environ:`LANG` environment will be set to
   the language environment reported by the client.

tl-shadow-notify
   This command starts the :program:`tl-shadow-notify` command for the
   lifetime of the session. This will enable notifications when the
   session is shadowed.

tl-single-app <*command*> [*arguments*]
   The :program:`tl-single-app` command can be used to execute a single
   application in a ThinLinc session. A window manager with a suitable
   configuration is automatically started. All top level windows are
   automatically maximized. Window titles are displayed in the title bar
   of the ThinLinc Client, not in the ThinLinc session. The client close
   button will disconnect the session as usual. Inner close buttons
   closes application windows. The :program:`tl-single-app` command can
   be specified as a client supplied start program (see
   :ref:`configuration_start_program`), or used with the ThinLinc
   profile selector (see :ref:`configuration_config-profiles`).

   .. tip::

      If the application opens multiple top level windows, you can
      switch between them by clicking on the application icon in the top
      left corner.

tl-sso-update-password
   This command requests a password from the user, to be used with the
   Single Sign-On mechanism of ThinLinc. It is useful when the password
   is not already available, for example, when using One Time Passwords.
   See :ref:`authentication_securid` for more information.

tl-support [**-p** <*listen-port*>] [**-u** <*user*>] [*host*]
   The :program:`tl-support` command can be used to enable a support
   technician to login to your ThinLinc server, even though the server
   is behind a firewall that doesn't allow connections to the ssh port.
   This is accomplished by opening a ssh connection from the server to
   an external server on the internet, at the same time setting up a
   tunnel from the remote host to the local host's ssh port. The default
   server to connect to is "support.thinlinc.com" with the default
   username "support". This command should only be used after
   contacting your ThinLinc support technician.

tl-disconnect
   This command is used to disconnect from the current session. This can
   be used to provide an alternative to the :kbd:`F8` key, such as a
   disconnect button on the Gnome panel.

tl-sso-password [**\-\-check**] [**\-\-remove**]
   This command can be used to hook up the Single Sign-on mechanism of
   ThinLinc with new applications. It can be used to test for the
   presence of a valid password and to feed that password out on
   standard output to another application.

   To check for the existance of a valid password, invoke the command as
   :option:`tl-sso-password --check`. A return code of zero indicates a
   valid password.

   If the :option:`--remove` option is specified, the password will be
   removed, after the retrieval or check.

   There are two basic models to connect :program:`tl-sso-password` to
   an application. The first is to use shell pipes:

   .. code:: console

      $ tl-sso-password | /usr/bin/application --read-password-on-stdin

   The second is to have the application invoke
   :program:`tl-sso-password` as needed:

   .. code:: console

      $ /usr/bin/application --password-prog tl-sso-password

tl-sso-token-passphrase [**\-\-check**] [**\-\-remove**]
   This command is identical to :program:`tl-sso-password`, except that
   it uses the smart card token passphrase (PIN) instead of the user's
   password. For usage, see the :program:`tl-sso-password` section
   above.

tl-env [**-d**] [**-n** <*nr*>] <*command*> [*arg*...], tl-env **-s** [**-n** <*nr*>]
   This command can be used to save and restore the ThinLinc session
   environment variables. It operates on the file :file:`xstartup.env`
   in the session directory. During session startup, :program:`tl-env`
   is called with the :option:`-s` option after everything in
   :file:`xstartup.d` have been executed. Later, tl-env can be used to
   execute a command in this environment, even outside the ThinLinc
   session. During restore, the :environ:`DISPLAY` environment variable
   can be excluded by specifying :option:`-d`. By default, this command
   operates on the "last" session number for the invoking user. An
   alternative session number can be specified with the :option:`-n`
   option.

Commands in /opt/thinlinc/sbin
------------------------------

tl-notify [**-u** <*username*>] <*message*>
   This command sends a user-visible message to ThinLinc sessions on the
   server. The default is to send the message to all sessions, but the
   :option:`-u` option can be used to send the message to a single
   recipient  instead.

   To send messages to all users in a ThinLinc cluster, you can use this
   command in combination with the :program:`tl-ssh-all` command
   described in this section.

tl-rsync-all
   This command is used to synchronize files and directories in a
   ThinLinc cluster. It runs the rsync command over SSH against all
   agent servers in the cluster.

tl-ssh-all
   This command is used to perform shell commands on all agents in a
   ThinLinc cluster. It works by running the ssh command against all
   agent servers in the cluster.

Commands in /opt/thinlinc/libexec
---------------------------------

tl-kinit.sh
   The :program:`tl-kinit.sh` command is used to obtain a Kerberos
   ticket automatically during start of the session, using the single
   sign-on mechanism.

tl-kdestroy.sh
   The :program:`tl-kdestroy.sh` command is used to destroy the Kerberos
   ticket cache. It calls :command:`kdestroy` during logout.
